[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ale] NTP and 'ipchains'

If you have a rule using connection tracking ($IPTABLES -A allowed -p
TCP -m state --state ESTABLISHED,RELATED -j ACCEPT) then responses are
allowed to connection initiated from the inside.

But,alas, udp is connectionless so you need the explicit rule.

On Sat, 2004-01-17 at 16:10, John Mills wrote:
> ALErs -
> I'm running RH-7.3 and 'ipchains'. My LAN sits behind a firewall/router
> that forwards only port 22 to serve incoming SSH. In order for 'ntpdate'
> to successfully connect to outside servers, I had to add an 'ipchains'
> rule:
>  -A input -s 0/0 -d 0/0 123 -p udp -j ACCEPT
> I didn't have to forward this port back through the router/firewall, 
> however.
> Was it normal to need such a rule when I don't need rules to pass other
> sorts of replies, such as responses to telnet and http inquiries to other
> hosts?
> Thanks for any background on this.
>  - John Mills
>    john.m.mills at alum.mit.edu
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
doug mcnash