THE STORY:
Two servers, one connected directly to the Internet, the other behind the first one (and using it as a NAT router / firewall).
Both run ntpd.
The outer one synchronises fine, and gets to be stratum 3.
The inner one, however, remains on stratum 16, even after half an hour, despite "ntpdc peers" showing the outer server as a fully reachable peer. And we can manually run ntpdate against fear-int, and it works fine.
alaric@infatuation$ ntptrace
localhost.: stratum 16, offset 0.000000, synch distance 0.011955
alaric@infatuation$ sleep 1800 ; ntptrace
localhost.: stratum 16, offset 0.000000, synch distance 0.039855
alaric@infatuation$ ntpdc
ntpdc> peers
remote local st poll reach delay offset disp
=======================================================================
=fear-int 192.168.3.2 3 64 377 0.00011 -0.327713 0.00461
ntpdc> q
alaric@infatuation$ ntptrace
localhost.: stratum 16, offset 0.000000, synch distance 0.066660
alaric@infatuation$ less /etc/ntp.conf
alaric@infatuation$ cat /etc/ntp.conf | grep -v '^#'
pidfile /var/run/ntpd.pid
driftfile /var/db/ntp.drift
logconfig -syncstatus
tos minsane 2
server fear-int