one more finding for you In some cases ISP provides incorrect NTP server IP via DHCP (it doesn't block NTP requests, but provides incorrect servers for sync). for Mikrotik routers - check your NTP...