From 8da600847cca5914b906ab50d7123817edbf9bc3 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Thu, 20 Aug 2026 19:23:12 -0700 Subject: [PATCH] fix(vyos): allow NTP to gw01 from management and OOB VLANs chrony on gw01 is synced and allows all clients, but MGMT_LOCAL and OOB_LOCAL never accepted UDP 123, so sw-core01 (and any OOB device, which has no internet path at all) could not sync. Verified live: client packets arrive on gw01 with no reply and chronyc serverstats shows zero NTP packets received. --- vyos/gw01/config.boot.tmpl | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/vyos/gw01/config.boot.tmpl b/vyos/gw01/config.boot.tmpl index 05e0511..0fc14db 100644 --- a/vyos/gw01/config.boot.tmpl +++ b/vyos/gw01/config.boot.tmpl @@ -253,6 +253,14 @@ firewall { } protocol udp } + rule 60 { + action accept + description "Allow NTP" + destination { + port 123 + } + protocol udp + } } name OOB_FORWARD { default-action drop @@ -300,6 +308,14 @@ firewall { } protocol udp } + rule 60 { + action accept + description "Allow NTP" + destination { + port 123 + } + protocol udp + } } name SANDBOX_FORWARD { default-action drop