How to configure the GL.iNet router as an NTP server and redirect all LAN clients NTP request?

Routers
1

Hello,

This tutorial will guide you to set the router to NTP (network time synchronization) server and overwrite it to the LAN client's NTP service (Including the LAN port and WiFi clients) .

There is no need to change the NTP server configuration on all clients. As long as the client is connected to the router LAN port or main WiFi, when it needs to sync time, it will be responded by the router's NTP server and provide the time sync service.

  1. SSH to router

  2. Check whether the router system time is correct:

date

# If the time is not sync, you can trigger it manually:
/etc/init.d/sysntpd restart
  1. Enable NTP server of router:
uci set system.ntp.enable_server='1'
uci commit system
/etc/init.d/sysntpd restart
  1. Using the help of firewall rules, all NTP requests from listening to LAN clients are redirected to the NTP server of the router itself:
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 123 -j DNAT --to-destination [Router LAN IP]:123

# Please use your router's actual LAN IP. 123 is a fixed NTP service port.
# For example, the router LAN IP of the NTP server is 192.168.8.1. 
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 123 -j DNAT --to-destination 192.168.8.1:123
  1. Check whether the firewall rule is added and whether the port is starting to listen:
iptables -t nat -L PREROUTING -v
netstat -uln | grep 123

Bruce_2025-09-30_19-18-56

Bruce_2025-09-30_19-27-22

  1. Add the above firewall rule to /etc/rc.local, ensure the rule always takes effect after router restart:
sed -i '/^exit 0$/i iptables -t nat -A PREROUTING -i br-lan -p udp --dport 123 -j DNAT --to-destination 192.168.8.1:123' /etc/rc.local
  1. Verify whether to obtain the time information of the NTP server of the router in Windows PowerShell (Arbitrary public IP/domain)
w32tm /stripchart /computer:www.google.com /dataonly /samples:3

w32tm /stripchart /computer:123.123.123.123 /dataonly /samples:3

Bruce_2025-09-30_19-52-17
Bruce_2025-09-30_19-52-17670×210 2.37 KB

-end

5 Likes
2

Thanks! Works on my X3000. It would be nice if this was added to the firmware as on option in the gui.

1 Like
3

By doing this, is the iptables rule visible in Luci Network Firewall Rules?

4

Just checked, it doesn't appear in the firewall overview in Luci as far as I can tell.

5

This feature may appeal to a smaller audience.
We will continue to collect user requirements and reassess its potential at a later stage.

Thanks!

6

Hello! FWIW, I would like to express my interest in this feature being made easier to access and configure from the GUI.

In the meantime, thank you for the guide! Seems to be working well on my network so far.

1 Like
7

I would also love to see this feature added to the GUI.

We buy at least 4 routers a year, and this feature would simplify our setup process a lot.

8

Hello,

Thank you for your feedback.

Since the limited number of users currently utilizing this feature, we do not have immediate plans to add it to the GL GUI.

We will continue to monitor the demand for this feature. Once it exceeds a certain volume, we will initiate an evaluation.

Thank you!

9

I’ll add my vote for this feature. While the above guide works (thanks!), a GUI feature would be helpful.

10

Thanks for the suggestions.

1 Like
11

Limited number of users is utilizing a feature that doesn’t exist? Genius deduction…

It must also require a tremendous amount of resources to add a feature that basically exists and only needs a few lines of code to appear in your GUI. Yet you can afford releasing more and more routers that have almost exactly identical specs and set of features, while people keep asking for the most basic features like this one for years. Talking about priorities. Among which customer satisfaction is nowhere to be seen.

12

On GL-BE3600 it doesn’t matter if this option is set, sysntpd doesn’t listen on port 123.

13

Because kernel apparently lacks CONFIG_SECURITY_CAPABILITIES that is required by /etc/init.d/sysntpd right here:

[ -x /sbin/ujail -a -e /etc/capabilities/ntpd.json ] && { procd_add_jail ntpd ubus procd_add_jail_mount "$HOTPLUG_SCRIPT" procd_add_jail_mount "/usr/share/libubox/jshn.sh" procd_add_jail_mount "/usr/bin/env" procd_add_jail_mount "/usr/bin/jshn" procd_add_jail_mount "/bin/ubus" grep -q CONFIG_CAPABILITIES /proc/config.gz || return procd_set_param capabilities /etc/capabilities/ntpd.json procd_set_param user ntp procd_set_param group ntp procd_set_param no_new_privs 1 }

14

Many thanks for this info.

15

Is this the same as NTP time in Luci Settings? There we have the option to serve as NTP server to lan hosts.

16

Sincerely apologize. We highly value every customer's requires and suggestions, and we have a complete internal evaluation process for every requires.

The reason for posting this guide is that we treat every request with care, we distilled it into a simple, quick guide so that users can achieve the desired feature with less time cost.

Given the current volume of requests, we have an internal assessment with the PM team, it will continue to monitor the number of user requests.

17

There is a slight difference: this is a redirection of NTP requests, meaning that no matter what NTP server the client uses, the NTP requests will be redirected by the router to the router’s own NTP server.

1 Like