Why VW needs access to IP 86.105.246.247 for NTP server check to indicate "Server NTP Ok"?

[Outtakes1110]

Hello,

Thanks dani-garcia and the contributors for continuous work on this project.

I just had a question, I'm sure there is a fairly basic answer.

Does anybody know why VW needs https (443) access to IP 86.105.246.247 in order to indicate the "Server NTP Ok" on the diagnostics date time checks.

Without access to that address the diagnostic check on the admin page will show "NTP: Unable to fetch NTP time".

Is it cross checking the time with a NTP server via https in order to show the "Server NTP Ok" message?

Regards,
Outakes

[BlackDex]

Because we use an external service to fetch current NTP date/time to validate if the time in the server/client is correct.

Since a server and client might match together, but still have a large offset with the actual date/time according to NTP.

[bokkabonga]

Would it be possible to set a custom NTP Server via the admin interface or docker-compose?

[BlackDex]

No, since we do not use an NTP protocol, but a web-api. Also, there could be a risk of using an internal NTP server which might also have a too large offset, which then defeats the point of having that check.

It might be an option to switch to Cloudflare's 1.1.1.1 which could also provide the data, but that might also give issues.
You can also keep it firewalled and just do not have the check to succeed.

[bokkabonga]

Sad :/ We have our own NTP Server which is kept in sync. Would have been nice to use this, so we can keep the firewall as closed as possible.

But I get it, if thats out of scope for this project ^^

[Outtakes1110]

Thanks for the explanation.

From a security standpoint, I might just keep it firewalled, unless I need to run diagnostic checks, in that case. Appreciated.