My server's clock is wrong because the firewall doesn't permit ntp traffic. What are the iptables rules required to allow the ntp client to get out and back?
Any suggestions how to implement those rules on Ubuntu also appreciated.
2
-
You mean so that your machine can act as a NTP server?– Ignacio Vazquez-AbramsCommented May 16, 2010 at 14:48
-
1Acting as client.– John MeeCommented May 17, 2010 at 1:46
Add a comment
|
2 Answers
"out and back" implies you are an NTP client and want to talk to a server i'd imagine by default you can do this; if you haven't set up a firewall to block everything, and have iptables set up at all, you'll have a "allow related/established" rule which means replies to outgoing requests are allowed automatically
in any case, NTP is UDP port 123, so, assuming you are a CLIENT and want to access NTP servers you'd do:
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
iptables -A INPUT -p udp --sport 123 -j ACCEPT
these will append the rules to the end of your OUTPUT and INPUT chains
Assuming you want to be a server, you'd do
iptables -A INPUT -p udp --dport 123 -j ACCEPT
iptables -A OUTPUT -p udp --sport 123 -j ACCEPT
I have a script which implements all my firewall rules, and I call it from /etc/rc.local which runs on startup on my machine (ubuntu 8.04 LTS)
EDIT: You've clarified that this is because you are a client. In ubuntu's default configuration, you shouldn't have to alter any firewall settings to do this. What firewall configuration have you done? If nothing, I'm inclinced to believe that this isn't a firewall issue.
-
There is a problem with the rule: > iptables -A INPUT -p udp --sport 123 -j ACCEPT With the above rule someone can connect to another protected port on your server, though connect is not the right term because it is udp. I will return and edit this once I find the answer.– user191113Commented Jan 18, 2013 at 23:52
-
Like I said, most clients will have a "allow related/established" rule - that is better because it makes a note of your outgoing query (to port 123 from port somethingRandom) and will allow the incoming packet from that IP from port 123 to port somethingRandom only Commented Jan 24, 2013 at 1:47
-
It seems that even when I'm trying to be a Client only, I have to add this rule
iptables -A INPUT -p udp --dport 123 -j ACCEPTin my case– xi.linCommented Jun 2, 2017 at 8:11
# Allow NTP And Protect Port 123
iptables -A INPUT -i lo -p udp --destination-port 123 -j ACCEPT
iptables -A INPUT -p udp --source-port 123:123 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o lo -p udp --source-port 123 -j ACCEPT
iptables -A OUTPUT -p udp --destination-port 123:123 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --destination-port 123 -j DROP
-
Your answer would be even better with an explanation of the commands Commented Feb 21, 2023 at 0:25