21

From What are the iptables rules to permit ntp?:

iptables -A INPUT -p udp --dport 123 -j ACCEPT
iptables -A OUTPUT -p udp --sport 123 -j ACCEPT

Also, from the NTP website:

... ntpd requires full bidirectional access to the privileged UDP port 123. ...

My question is, why? To someone not familiar with NTP, this seems like a potential security hole, especially when I'm asking a client of mine to open up that port in their firewall so that my servers can keep their time synchronised. Does anyone have a decent justification I can give to my client to convince them that I need this access in the firewall? Help is appreciated! :)

8
  • 2
    Have you read the part about "allow related/established"? If this rule's present there's no need for a general input rule for UDP port 123.
    – VMai
    Jun 2, 2014 at 13:16
  • 1
    Is this really a potential security hole? This is anoften repeated phrase that I think is meaningless. It is 2014, time to not imbue ports less than 1024 with special properties and block all traffic that is not explicitly required. You are opening up one port to one machine from certain hosts on the internet.
    – dfc
    Jun 2, 2014 at 21:40
  • I agree, it's not really a potential security hole, but I work in the financial industry and people are always nervous about opening up firewalls in case "something gets through". It's always worth having a good justification on hand, plus I'm curious about the answer myself - does ntpd on a time server actually make outgoing connections to its clients to send time updates? That sounds weird and not particularly scalable. Jun 3, 2014 at 10:39
  • I googled this one a few days ago, it can manage without an incoming connection made.
    – barlop
    Jun 6, 2014 at 18:41
  • @VMai the person that said that on superuser.com/questions/141772/… gave no example, but I think he meant to enable outgoing connections, packets coming in within them. That is different to the concept that "ntpd requires full bidirectional access to the privileged UDP port 123. ..." which sounds like an incoming connection. If he wanted to allow incoming and outgoing using related/established then he'd need 4 rules. 2 for incoming connections, 2 for outgoing connections.
    – barlop
    Jun 6, 2014 at 18:48

4 Answers 4

12

You only need allow incoming traffic NTP's ports if you are acting as a server, allowing clients to sync to you.

Otherwise, the existance of an NTP state will automatically determine whether the incoming NTP packet is blocked or allowed by an existing firewall state that we initiated.

iptables -A OUTPUT -p udp --sport 123 --dport 123 -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Please let me know if the iptables rules are proper. I have no experience with iptables. My NTP client stays synchronized on my pfSense router with only an outgoing allow rule because pfSense is a stateful firewall.

2
  • 1
    This does seem sensible! Unfortunately I am no longer in a position to confirm the correctness of your answer; however, I will accept it because it does seem logical. Many thanks! Nov 16, 2015 at 12:04
  • Question remains: why does ntp listen to that incomming port by default. That seems like a broken implementation to me and brings alot of confusion. Other implementations like openntp do not have that requirement at all.
    – omni
    Mar 8, 2020 at 9:27
3

NTP requires bi-directional access on port 123 because the NTP RFC specifies the following regarding the source port of the client:

When operating in symmetric modes (1 and 2), this field must contain the NTP port number PORT (123) assigned by the IANA.

Since the client's source port is 123, when the server sends the response back it'll send it to port 123. Naturally, in order to be able to receive that response the client must allow incoming responses on port 123. Normally responses would come back on some ephemeral port range.

As Ben Cook mentioned above, this is only required when dealing with a stateless firewall as a stateful firewall would allow the response to come back without an explicit rule.

-1

I think that the best solution is to enable port 123 for input, only for the ip addresses expected to give your server the ntp signal.
Inside the ntp config file, /etc/ntp.conf, there are the addresses of several ntp servers your server should point on. You may use the lookup command to find the corresponding ip for each address.

host -t a 0.debian.pool.ntp.org

Then you can add the rule to the server firewall:

iptables -I INPUT -p udp -s 94.177.187.22 -j ACCEPT

...and so on.
This may prevent any malicious person to damage your server.
I think it is no use restricting the output.

1
  • No, due to ip-spoofing this is definitely not the best solution. Ben Cook's answer to restrict the incomming port only for established and related connections is a way better solution that would require a MITM attack (which in general is harder to do). Yet the best solution imho is not to use ntp at all but rather switch to another implementation such as openntp that doesn't require a open incomming port at all.
    – omni
    Mar 8, 2020 at 9:31
-2

ntp server to server communication is source and destination port 123. It is most convenient to explicitly allow that at least to the hosts on which you are running a ntp service.

You might consider only exposing an external host to the Internet to get time from outside sources. An internal ntp service syncing to this can be the source for all devices. If these hosts are dedicated to the purpose the possible exposure is limited: they only accept ntp traffic and do not store other data.

Alternately, do not use an external IP network at all. Use a radio source like GPS for time, for example.

http://www.diablotin.com/librairie/networking/firewall/ch08_13.htm http://support.ntp.org/bin/view/Support/TroubleshootingNTP

1
  • 1
    Thanks for this answer, but it doesn't answer the question. What if I am the system administrator and want to open up my firewall so that I can set up the internal NTP service? Nobody still seems to have any idea why bi-directional access (which is much more dangerous than uni-directional access) is required for NTP. Jul 24, 2015 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .