NTP forwarding
Hi,
i have following network structure:
NTP-Server (62.214.6.29)
|
|
|
(eth0: 10.0.0.95)
Embedded board
(eth1: 192.168.31.95)
|
|
| Ethernet-Switch
| | |
| | |
PC1 | PC3 (192.168.31.98)
(192.168.31.96) |
|
PC2(192.168.31.97)
The 3 PCs shall be able to connect to the NTP server (62.214.6.29) to update their time but i cannot figure out how to configure the iptables rules on the embedded board to achieve this.
I have tried to forward port 123 but it does not work.
Regards
Tobias
Quoted 21 lines · Tobias Andresen
i have following network structure:
NTP-Server (62.214.6.29) | | | (eth0: 10.0.0.95) Embedded board (eth1: 192.168.31.95) | | | Ethernet-Switch | | | | | | PC1 | PC3 (192.168.31.98) (192.168.31.96) | | PC2
Quoted 7 lines
(192.168.31.97)
The 3 PCs shall be able to connect to the NTP server (62.214.6.29) to update their time but i cannot figure out how to configure the iptables rules
on the embedded board to achieve this.
Why do you think you need iptables rules ? Isn't plain routing enough ?
Quoted 1 line
I have tried to forward port 123 but it does not work.
This statement does not contain any useful information. It does not describe what you did and what happened.
Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
Quoted 24 lines
Quoted 23 lines · Tobias Andresen
i have following network structure:
NTP-Server (62.214.6.29) | | | (eth0: 10.0.0.95) Embedded board (eth1: 192.168.31.95) | | | Ethernet-Switch | | | | | | PC1 | PC3 (192.168.31.98) (192.168.31.96) | | PC2(192.168.31.97)
Quoted 5 lines
Quoted 4 lines
The 3 PCs shall be able to connect to the NTP server (62.214.6.29) to update their time but i cannot figure out how to configure the iptables rules
on the embedded board to achieve this.Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able tohave full access (i.e. internet, ...)
Quoted 4 lines
Quoted 2 lines
I have tried to forward port 123 but it does not work.
This statement does not contain any useful information. It does not describe what you did and what happened.
I tried following rule for one PC:
iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT --to-destination 192.168.31.96:123 iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
I know this would work only for one client but it was for testing purposes.
Quoted 4 lines
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 5 lines · Tobias Andresen
Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
Quoted 1 line
Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able tohave full access (i.e. internet, ...)
Then you need filtering, not NAT.
Quoted 4 lines
I tried following rule for one PC:
iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT --to-destination 192.168.31.96:123
What is the purpose of this rule ? It redirects NTP packets to 192.168.31.96. How do you expect that NTP packets eventually reach 62.214.6.29 ?
Quoted 1 line
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
Why is this rule needed ? What's between 10.0.0.95 and 62.214.6.29 ?
Am 06.03.2016 um 22:40 schrieb Pascal Hambourg:
Quoted 9 lines
Quoted 4 lines · Tobias Andresen
Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
Quoted 1 line
Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able tohave full access (i.e. internet, ...)
Then you need filtering, not NAT.
Quoted 2 lines
I tried following rule for one PC:
Quoted 8 lines
Quoted 2 lines
iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT --to-destination 192.168.31.96:123
What is the purpose of this rule ? It redirects NTP packets to 192.168.31.96. How do you expect that NTP packets eventually reach 62.214.6.29 ?
Quoted 1 line
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
Why is this rule needed ? What's between 10.0.0.95 and 62.214.6.29 ?
This is the internet connection.
I cannot achieve this by using iptables or why would you prefer plain routing?
I thought i have to use iptables because the ntp server (62.214.6.29) does not know who is behind 10.0.0.95 and the embedded device has to change the source and destination address...
Quoted 7 lines · Tobias Andresen
Am 06.03.2016 um 22:40 schrieb Pascal Hambourg:
Quoted 4 lines
Quoted 2 lines
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
Why is this rule needed ? What's between 10.0.0.95 and 62.214.6.29 ?
This is the internet connection.
But I suppose it is not a simple wire. 10.0.0.95 is a private address and 62.214.6.29 is a public IP address, so there must be some sort of NAT router between them. Am I correct ?
Quoted 2 lines
I cannot achieve this by using iptables or why would you prefer plain routing?
Because the action of carrying packets from the source to the destination is done by routing.
Quoted 3 lines
I thought i have to use iptables because the ntp server (62.214.6.29) does not know who is behind 10.0.0.95
and the embedded device has to change the source and destination address...
Why ? IIUC 62.214.6.29 is a public address on the internet and 10.0.0.95 is a private address on your LAN, so the NTP server does not know about 10.0.0.95 either. The job of changing private addresses must be performed by some other device connected to the same network as eth0. Only that device needs to know about your private addresses.
Hi,
I am thinking this is enough f for you.
At Embedded board :
iptables -A FORWARD -p udp --dport 123 -s 192.168.31.96/30 -j ACCEPT
iptables -A FORWARD -s 192.168.31.96/30 -j DROP
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
sysctl -w net.ipv6.conf.all.forwarding=1
After that please check your all ip tables rules like as;
iptables-save
iptables -L -vnx --line-numbers
iptables -L -t nat -vnx --line-numbers
03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
Quoted 58 lines
Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
Quoted 24 lines
Quoted 23 lines · Tobias Andresen
i have following network structure:
NTP-Server (62.214.6.29) | | | (eth0: 10.0.0.95) Embedded board (eth1: 192.168.31.95) | | | Ethernet-Switch | | | | | | PC1 | PC3 (192.168.31.98) (192.168.31.96) | | PC2(192.168.31.97)
Quoted 5 lines
Quoted 4 lines
The 3 PCs shall be able to connect to the NTP server (62.214.6.29) to update their time but i cannot figure out how to configure the iptables rules
on the embedded board to achieve this.Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able tohave full access (i.e. internet, ...)
Quoted 4 lines
Quoted 2 lines
I have tried to forward port 123 but it does not work.
This statement does not contain any useful information. It does not describe what you did and what happened.
I tried following rule for one PC:
iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT --to-destination 192.168.31.96:123
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADEI know this would work only for one client but it was for testing purposes.
Quoted 4 lines
Signature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.htmlSignature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Am 07.03.2016 um 04:49 schrieb Remzi AKYÜZ:
Quoted 14 lines
Hi,
I am thinking this is enough f for you.
At Embedded board :
iptables -A FORWARD -p udp --dport 123 -s 192.168.31.96/30 -j ACCEPT
iptables -A FORWARD -s 192.168.31.96/30 -j DROP
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
sysctl -w net.ipv6.conf.all.forwarding=1
Quoted 7 lines
After that please check your all ip tables rules like as;
iptables-save
iptables -L -vnx --line-numbers
iptables -L -t nat -vnx --line-numbers
Thanks for your help but it seems not to work.
Quoted 56 lines
03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
Quoted 55 lines
Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
Quoted 24 lines
Quoted 23 lines · Tobias Andresen
i have following network structure:
NTP-Server (62.214.6.29) | | | (eth0: 10.0.0.95) Embedded board (eth1: 192.168.31.95) | | | Ethernet-Switch | | | | | | PC1 | PC3 (192.168.31.98) (192.168.31.96) | | PC2(192.168.31.97)
Quoted 5 lines
Quoted 4 lines
The 3 PCs shall be able to connect to the NTP server (62.214.6.29) to update their time but i cannot figure out how to configure the iptables rules
on the embedded board to achieve this.Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able tohave full access (i.e. internet, ...)
Quoted 3 lines
Quoted 1 line
I have tried to forward port 123 but it does not work.
This statement does not contain any useful information. It does not describe what you did and what happened.
I tried following rule for one PC:
iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT --to-destination 192.168.31.96:123
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADEI know this would work only for one client but it was for testing purposes.
Quoted 4 lines
Signature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.htmlSignature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 15 lines · Tobias Andresen
Am 07.03.2016 um 04:49 schrieb Remzi AKYÜZ:
Quoted 14 lines
Hi,
I am thinking this is enough f for you.
At Embedded board :
iptables -A FORWARD -p udp --dport 123 -s 192.168.31.96/30 -j ACCEPT
iptables -A FORWARD -s 192.168.31.96/30 -j DROP
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
sysctl -w net.ipv6.conf.all.forwarding=1
Quoted 8 lines
Quoted 7 lines
After that please check your all ip tables rules like as;
iptables-save
iptables -L -vnx --line-numbers
iptables -L -t nat -vnx --line-numbers
Thanks for your help but it seems not to work.
Please try the following commands too (besides the above ones).
At Embedded board: (enable ipv4 forwarding)
sysctl -w net.ipv4.conf.all.forwarding=1
At the PCs: (set default gateway, if not done already)
ip route add default via 192.168.31.95
Vignesh
Quoted 64 lines
Quoted 58 lines
03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
Quoted 55 lines
Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
Quoted 24 lines
Quoted 23 lines · Tobias Andresen
i have following network structure:
NTP-Server (62.214.6.29) | | | (eth0: 10.0.0.95) Embedded board (eth1: 192.168.31.95) | | | Ethernet-Switch | | | | | | PC1 | PC3 (192.168.31.98) (192.168.31.96) | | PC2(192.168.31.97)
Quoted 5 lines
Quoted 4 lines
The 3 PCs shall be able to connect to the NTP server (62.214.6.29) to update their time but i cannot figure out how to configure the iptables rules
on the embedded board to achieve this.Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able tohave full access (i.e. internet, ...)
Quoted 3 lines
Quoted 1 line
I have tried to forward port 123 but it does not work.
This statement does not contain any useful information. It does not describe what you did and what happened.
I tried following rule for one PC:
iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT --to-destination 192.168.31.96:123
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADEI know this would work only for one client but it was for testing purposes.
Quoted 4 lines
Signature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.htmlSignature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.htmlSignature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
sysctl -w net.ipv6.conf.all.forwarding=1 should be sysctl -w net.ipv4.conf.all.forwarding=1
After sysctl -w net.ipv4.conf.all.forwarding=1 it should work. It is not work, check your all rules and route.
03/07/2016 09:26 AM tarihinde Tobias Andresen yazdı:
Quoted 84 lines
Am 07.03.2016 um 04:49 schrieb Remzi AKYÜZ:
Quoted 14 lines
Hi,
I am thinking this is enough f for you.
At Embedded board :
iptables -A FORWARD -p udp --dport 123 -s 192.168.31.96/30 -j ACCEPT
iptables -A FORWARD -s 192.168.31.96/30 -j DROP
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
sysctl -w net.ipv6.conf.all.forwarding=1
Quoted 7 lines
After that please check your all ip tables rules like as;
iptables-save
iptables -L -vnx --line-numbers
iptables -L -t nat -vnx --line-numbers
Thanks for your help but it seems not to work.
Quoted 58 lines
03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
Quoted 57 lines
Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
Quoted 24 lines
Quoted 23 lines · Tobias Andresen
i have following network structure:
NTP-Server (62.214.6.29) | | | (eth0: 10.0.0.95) Embedded board (eth1: 192.168.31.95) | | | Ethernet-Switch | | | | | | PC1 | PC3 (192.168.31.98) (192.168.31.96) | | PC2(192.168.31.97)
Quoted 6 lines
Quoted 4 lines
The 3 PCs shall be able to connect to the NTP server (62.214.6.29) to update their time but i cannot figure out how to configure the iptables rules
on the embedded board to achieve this.Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able tohave full access (i.e. internet, ...)
Quoted 3 lines
Quoted 1 line
I have tried to forward port 123 but it does not work.
This statement does not contain any useful information. It does not describe what you did and what happened.
I tried following rule for one PC:
iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT --to-destination 192.168.31.96:123
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADEI know this would work only for one client but it was for testing purposes.
Quoted 5 lines
Signature · 4 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.htmlSignature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi,
Am 05.03.2016 um 15:15 schrieb Tobias Andresen:
Quoted 1 line
I have tried to forward port 123 but it does not work.
Regardless of whether you can make the forwarding work or not, maybe it would be a better idea to run your own NTP server on the embedded board?
Best regards,
Karol Babioch