tl:dr - I want to receive NTP updates from the NTP.org pool on my router, while giving NTP updates to local network clients, and blocking NTP requests coming from the internet.
This configuration is just a a private home project that I'm working on. I'm practicing on a router and I want to see if I can make this configuration work. I understand this may not be optimal usage of NTP.
I'm trying to configure a Cisco 1921 router to serve as an NTP server to my home network, and retrieve NTP updates from the NTP.org pool. I want to do this while blocking NTP client requests from the internet to my router's WAN address.
I've been able to get both the NTP client updates from 0.us.pool.ntp.org, and distribute NTP server updates to home and internet clients working on the router with no ACLs applied. Once I had this working, I started getting NTP requests into the router on the WAN address.
Every attempt I've made to block NTP requests from the internet have resulted in behavior I don't want. Either the NTP pool is blocked, or the local clients are blocked, or any number of other variations of things I've tried that haven't worked.
I have a similar configuration already setup for DNS. I use the router as a DNS server for LAN clients, and allow the router to make lookups to public DNS servers. I blocked internet requests coming in on 53 while allowing the public DNS servers. This configuration has worked very well.
The main issue I see is that the NTP.org pool uses a pool of addresses. ACLs work on networks or individual hosts. Since I don't know which servers NTP.org is going to give me, I can't build a functional ACL that permits specific NTP traffic. Is there a way to make this configuration work?
If the configuration isn't going to work with the NTP pools, what is a recommended NTP server with a static IP that I can build this ACL around? Is it necessary to block NTP on the WAN after enabling NTP server for LAN clients? Is there another way to block this traffic that I am missing?
Thank you for your time.
