[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ale] NTP and 'ipchains'
- Subject: [ale] NTP and 'ipchains'
- From: dmcnash at charter.net (Doug McNash)
- Date: Sat Jan 17 16:42:11 2004
- In-reply-to: <[email protected]>
- References: <[email protected]>
If you have a rule using connection tracking ($IPTABLES -A allowed -p
TCP -m state --state ESTABLISHED,RELATED -j ACCEPT) then responses are
allowed to connection initiated from the inside.
But,alas, udp is connectionless so you need the explicit rule.
On Sat, 2004-01-17 at 16:10, John Mills wrote:
> ALErs -
> I'm running RH-7.3 and 'ipchains'. My LAN sits behind a firewall/router
> that forwards only port 22 to serve incoming SSH. In order for 'ntpdate'
> to successfully connect to outside servers, I had to add an 'ipchains'
> -A input -s 0/0 -d 0/0 123 -p udp -j ACCEPT
> I didn't have to forward this port back through the router/firewall,
> Was it normal to need such a rule when I don't need rules to pass other
> sorts of replies, such as responses to telnet and http inquiries to other
> Thanks for any background on this.
> - John Mills
> john.m.mills at alum.mit.edu
> Ale mailing list
> Ale at ale.org