ibinet/ntpsec repository overview

ibinet/ntpsec Lightweight NTP server based on ntpsec with a built-in nftables firewall, running on Docker with ipvlan L2 networking. The container gets its own LAN IP address and serves NTP directly to all devices on the network. Synchronized against Brazilian public GPS-backed NTP pools (stratum 1), delivering stratum 2 to LAN clients.

Requirements

Docker host with ipvlan support A pre-created lan-ipvlan Docker network

Create the ipvlan network bashdocker network create
--driver ipvlan
--opt ipvlan_mode=l2
--opt parent=ens33
--subnet=192.168.1.0/24
--gateway=192.168.1.1
--ip-range=192.168.1.192/27
lan-ipvlan

Replace ens33 with your host network interface. To find it: ip -br link show | grep -v lo

Run bash# ipvlan network must exist before running docker run -d
--name ibinet-ntpsec
--restart unless-stopped
--cap-add SYS_TIME
--cap-add SYS_NICE
--cap-add NET_ADMIN
--cap-add NET_RAW
--cap-add SYS_RESOURCE
-e TZ=America/Sao_Paulo
--network lan-ipvlan
--ip 192.168.1.150
-v /storage/ntpsec:/storage/ntpsec
ibinet/ntpsec:1.3.1

Adjust --ip to a free address in your LAN. Adjust TZ to your timezone (e.g. America/New_York, Europe/London).

Validate bash# NTP peers docker exec ibinet-ntpsec ntpq -p 127.0.0.1

⁠Server status

docker exec ibinet-ntpsec ntpq -c rv 127.0.0.1

⁠Firewall rules

docker exec ibinet-ntpsec nft list ruleset

Configure clients Linux ini# /etc/systemd/timesyncd.conf [Time] NTP=192.168.1.150 Windows (PowerShell — Admin) powershellw32tm /config /manualpeerlist:"192.168.1.150" /syncfromflags:manual /reliable:YES /update Stop-Service -Name W32Time ; Start-Service -Name W32Time w32tm /resync /force Mikrotik v7 /system ntp client set enabled=yes servers=192.168.1.150 Cisco ntp server 192.168.1.150

Firewall INPUT DROP by default. NTP port 123/udp accepted only from RFC1918 + CGNAT ranges: 10.0.0.0/8 · 172.16.0.0/12 · 192.168.0.0/16 · 100.64.0.0/10

Source github.com/N1utech/ibinet-ntpsec