Serve time to a private LAN

This guide turns the Chrony instance on a ROKO observer or ordinary Linux host into a restricted NTP server for home/lab computers.

It does not expose ROKO PTP² to LAN clients. PTP² and NTP are separate protocols.

Prerequisites

• the server has a stable LAN address;
• Chrony already uses at least three or four permitted, diverse sources;
• `chronyc tracking` reports synchronized;
• the host firewall can distinguish the LAN interface/subnet from the Internet.

Use `time.roko.network` as one source, not the only source.

Chrony configuration

Create a dedicated fragment using your actual LAN values:

# Upstream sources
server time.roko.network iburst
pool pool.ntp.org iburst maxsources 3
minsources 2
makestep 0.1 3
rtcsync

# Serve only the private LAN
allow <LAN_CIDR>
binddevice <LAN_INTERFACE>

# Disable the remote chronyc UDP command port
cmdport 0

# Limit abusive/misconfigured clients
ratelimit interval 3 burst 8 leak 2

Do not copy `<LAN_CIDR>` or `<LAN_INTERFACE>` literally. Use a narrow subnet; do not use `allow all` or `0/0`.

`cmdport 0` disables the remote UDP command interface. Local administration continues through Chrony's Unix socket.

Firewall

Permit UDP/123 only from `<LAN_CIDR>` on `<LAN_INTERFACE>`. Drop it on public interfaces. The exact command depends on your firewall manager; verify the effective rules after every reboot.

Do not open UDP/319 or UDP/320. ROKO PTP² is not IEEE 1588 PTP.

Validate the server

On the server:

sudo chronyc reload sources
chronyc tracking
chronyc sources -v
chronyc clients

On a LAN Linux client, add:

server <LAN_TIME_SERVER> iburst

Then inspect `chronyc sources -v` and `chronyc tracking`. macOS and Windows clients can use `<LAN_TIME_SERVER>` through their normal network time settings.

Test both sides of the boundary:

1. a LAN client receives NTP replies and converges; 2. a host outside the allowed subnet receives no reply; 3. a reboot restores firewall rules, upstream sync, and LAN service; 4. if upstream sources are unhealthy, the server does not claim a false local reference clock.

Security and accuracy notes

• NTP representation and actual accuracy are different. Wi-Fi, NAT, queueing,

and asymmetric paths add error.

• Standard NTP is unauthenticated unless NTS or another authenticated design is

configured. Do not add `nts` to a source that has not been verified to support it.

• Do not mix leap-smeared and non-smeared upstreams.
• Monitor loss of synchronization, root distance, falsetickers, reach, and

unexpected client volume.

• Follow RFC 8633 and the

Chrony configuration reference.