While this is not your core problem, I see you are using hostnames for your 'restrict' targets. Please see the first few lines of: http://ntp.isc.org/Support/AccessRestrictions H