Firewalls can block time synchronization traffic

Symptoms

• NTP or PTP clients do not synchronize across a firewall or between network segments
• WinDiscovery or management tools can see a device locally, but not from other subnets
• Time services work on one side of the network, but fail on the other

Possible causes

• Firewall or endpoint rules block the required UDP traffic.
• VLAN, routing, or ACL changes prevent traffic between the client and time source.
• Rules permit traffic for some hosts or network segments but not others.

Troubleshooting steps

1. Confirm the required ports and protocols are allowed.
   NTP uses UDP port 123. Other discovery or management tools may require additional ports. Ensure rules allow traffic in both directions where applicable.
2. Test reachability from the client network segment.
   Verify the client can reach the device IP from the same network path the time traffic will use. A test that works only on the local subnet may not represent cross-network behavior.
3. Check for recent network security changes.
   If the system worked previously and stopped suddenly, review recent firewall, VLAN, or ACL updates. Timing traffic is often blocked unintentionally during security hardening.
4. Validate client configuration.
   Confirm clients are pointed to the correct server IP or hostname and are using the intended protocol (NTP or PTP).

Related articles

• What port does NTP use?
• What ports does PTP use?
• Network ports and protocols for WinDiscovery and Masterclock applications