upmcplanetracker/ntpd-rs-nts-for-firewalla

This project is a community script that adds encrypted network time to a Firewalla router. It installs ntpd-rs, a time synchronization program that supports NTS, a protocol that authenticates and encrypts time requests so they cannot be silently altered by someone watching the network. It then uses Firewalla's own NTP Intercept feature to redirect every device on the local network to use this secure time service instead of whatever unencrypted server they were configured with. The README is upfront that this is not an official Firewalla product, carries real risk of destabilizing the router if misused, and should only be attempted by someone comfortable reflashing the device if something goes wrong. It also explains a limitation: devices behind NTP Intercept still only receive plain, unencrypted NTP, because that is the only protocol Firewalla intercepts, so any device that specifically requires NTS itself would need NTP Intercept turned off for its network segment. To install, a person places the script in a folder Firewalla already runs automatically after every boot and network change, downloads a companion configuration file that lists the NTS servers to use, and runs the installer. The script then finds the router's local network interfaces, installs the ntpd-rs package from its official prebuilt binary, disables any competing time services already running, adds the chosen NTS servers to the system's hosts file so they resolve even before local network lookups are ready, and sets up firewall rules to redirect all local time traffic to the new service. All of the editable settings, including the list of NTS servers, live in a separate configuration file rather than inside the script itself, so updating the server list does not require touching the installer. A verification command shows the current synchronization status and lists each configured time source along with its measured offset and delay, letting someone confirm the secure connections are actually working.