modified on 14 June 2010 at 07:17 ••• 37,106 views

Setup local NTP servers

From MikroTik Wiki

Jump to: navigation, search



Non of routerboards have battery backed up clock so it's good practice to set NTP client on all boards to be able to set proper time after boot. There are many public NTP servers on the Internet but it's always good to have some centralized control of time source and in addition lower load of public servers with the aid of local cache NTP servers.


  • Router doesn't need direct access to internet and public NTP servers
  • Allow to control primary source of clock for your router only on two main routers (primary and secondary)
  • It can reduce traffic and load of some public NTP servers by local time caching

RouterOS support setting of two servers for NTP client primary and secondary. It's better to setup and use two servers for redundancy if it's feasible. NTP servers should be located in independent locations with high availability near main gateways.

NTP Server

NTP server could be configured by WinBox in menu System - NTP Server or in command line /system/ntp/server. NTP server service is not included in default set of packages so it needs to be downloaded and installed manually with ntp.npk package.

If package is successfully installed then it can be simply enabled with Manycast support.

/system ntp server
set broadcast=no enabled=yes manycast=yes multicast=no

Local NTP servers need to be synchronized from Stratum 1 or Stratum 2 public servers. Pick some form public list.

/system ntp client
set enabled=yes mode=unicast primary-ntp= secondary-ntp=

Server ip mismatch

In routed network router can have multiple interfaces and ip addresses and NTP server running on such router can answer on different ip address then it received request. Then source NAT should be configured to solve this kind of problem which can result in Bad packet reason = server-ip-mismatch on client side.

/ip firewall nat add action=src-nat chain=srcnat comment="NTP" disabled=no \
  protocol=udp src-port=123 to-addresses=

Where is desired NTP server address. But this rule apply source NAT to all traffic going through so every other NTP server traffic will be SNATed to one address too. Then this rule can be more closely specified with src-address parameter configured to all other ip address which router have on other interfaces. Then if router have three addresses then two SNAT rules should be added like:

/ip firewall nat add action=src-nat chain=srcnat src-address="" \
  comment="NTP interface ether2" disabled=no protocol=udp src-port=123 to-addresses=
/ip firewall nat add action=src-nat chain=srcnat src-address="" \
  comment="NTP interface ether3" disabled=no protocol=udp src-port=123 to-addresses=

NTP Client

Now local NTP servers can be configured on every router in local network:

/system ntp client
set enabled=yes mode=unicast primary-ntp= secondary-ntp=

Also you should set time zone according your location on every router.

/system clock
set time-zone-name=CET

See also

External links