NTP broken in CARP

[A Former User]

When setting up a pair of CARP boxes, you need an outbound NAT rule to tell the second box it should use its WAN interface for the outgoing connection to other NTP servers.

Without the rule, the second box can't synchronize to outside servers, since it use a different IP for outgoing NTP connections (on mine, one of the CARP addresses), which results in packets from the remote servers hitting the primary box and getting dropped.

I propose that an outbound hidden rule is added as default for all installations, since it can't be bad to be safer than sorry.