NTP Intercept causes Eufy Doorbell camera not to work

[RMerlin]

Why is it connected to the guest network? Just connect it to the main and be done with it.

Because he wants to isolate it from his LAN (that's why he had Access Intranet disabled).

Tho considering recent discoveries related to Eufy, I'm not sure I would personally trust it with even WAN access...

 

[odiovidio]

Guest Network 2 works fine for me. So problem solved. No need to solve it for Guest 1.

Yes, Eufy had their dirty laundry spilled recently...can't say all the other ip camera companies aren't doing the same. Eufy's problem is they lied about it. I will never put one INSIDE my house...but for monitoring package deliveries, a doorbell camera is indispensable. I don't think there is an alternative that doesn't cost a monthly fee to spy on you.

 

[SomeWhereOverTheRainBow]

I have a Eufy doorbell on Guest Network 1 (GT-AX6000 388.1_0_rog). If I have NTP intercept ON, the doorbell keeps trying different NTP servers every few seconds, which means it's probably not getting the response it's waiting for.

View attachment 46153

Come to think of it, this issue started around the time I updated the firmware to 388.1.
As soon as I shut off NTP intercept, the camera starts working again and stops pinging different NTP servers.

Is this a bug in 388.1?

Surprised you havent tried the DNS rewrite techniques of adguardhome and just rewrite ntp addresses as rules to a different IP (ip of the ntp server you want to use).

Hosts Blocklists

Network-wide ads & trackers blocking DNS server. Contribute to AdguardTeam/AdGuardHome development by creating an account on GitHub.

github.com

 

[odiovidio]

Surprised you havent tried the DNS rewrite techniques of adguardhome and just rewrite ntp addresses as rules to a different IP (ip of the ntp server you want to use).

Yes, that would also work, and maybe I'll do that down the road. I just liked the simplicity of pressing a button in the GUI. Although your method would give me more control.

 

[SomeWhereOverTheRainBow]

Yes, that would also work, and maybe I'll do that down the road. I just liked the simplicity of pressing a button in the GUI. Although your method would give me more control.

it would actually helps the ntp redirect. I do something similar with my openwrt setup for clients that use common NTP servers. I trick the DNS service into responding with the NTP servers IP to kinda force compliance. I am curious to see if the camera has the same NTP issues on your regular network with the ntp redirect turned on. I experienced something similar with my Amazon Alexa a while back.

 

[RMerlin]

it would actually helps the ntp redirect. I do something similar with my openwrt setup for clients that use common NTP servers. I trick the DNS service into responding with the NTP servers IP to kinda force compliance. I am curious to see if the camera has the same NTP issues on your regular network with the ntp redirect turned on. I experienced something similar with my Amazon Alexa a while back.

The problem is that Guest Network 1 with Intranet access disabled is a separate bridge, with a different network. Clients are even provided a different IP address as their gateway. The L2 firewall is configured to completely isolate that network from the primary LAN, which is why NTP redirection to the router itself won't work. For it to work, the redirection would need to bind to that GN bridge interface rather than the main LAN bridge interface.

I initially thought the issue was simply iptables blocking access from that bridge, since it was working fine with DNS and DHCP through iptable rules part of the firewall. The reason why DHCP and DNS still works however is because dnsmasq is instructed to bind to both bridges. Busybox's ntpd does not allow binding to multiple interfaces, so fixing this would have required launching a separate instance bound to that second bridge interface.

DNS trickery would have been difficult to implement by the user, since as you can see that device was trying a long list of NTP servers.

 

[Mogsy]

Curious, probably out of topic. Always get Guest network 1 with 192.168.101.x and 192.168.102.x with port 53 unreplied. Works with DNS director (other than Router redirection) with port 53 assured. Need to adjust Guest clients with same subnet mask as router’s?

Why is it connected to the guest network? Just connect it to the main and be done with it.

Also not sure if this is best practise but I have Samsung TV (very chatty), and Sonos Arc on the main wifi. Sonos can receive Airplay from any LAN devices on Guest with intranet disabled, but can’t Airplay with Samsung unless it is on the main WiFi.

No problem with NTP

 

[SomeWhereOverTheRainBow]

View attachment 46311

Curious, probably out of topic. Always get Guest network 1 with 192.168.101.x and 192.168.102.x with port 53 unreplied. Works with DNS director (other than Router redirection) with port 53 assured. Need to adjust Guest clients with same subnet mask as router’s?


Also not sure if this is best practise but I have Samsung TV (very chatty), and Sonos Arc on the main wifi. Sonos can receive Airplay from any LAN devices on Guest with intranet disabled, but can’t Airplay with Samsung unless it is on the main WiFi.

No problem with NTP

Shouldn't this be a new thread topic since it does not relate to the ntp issue?

 

[Mogsy]

Shouldn't this be a new thread topic since it does not relate to the ntp issue?

Apologies. Just interested with the “put it on the main wifi and be done with it”. Did try here but not much interests