NTP forwarding

NTP forwarding

[Tobias Andresen]

Hi,

i have following network structure:


     NTP-Server (62.214.6.29)
               |
               |
               |
      (eth0: 10.0.0.95)
        Embedded board
    (eth1: 192.168.31.95)
               |
               |
               |
        Ethernet-Switch
         |        |    |
         |        |    |
        PC1       |   PC3 (192.168.31.98)
(192.168.31.96)  |
                  |
                 PC2
(192.168.31.97)


The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
to update their time but i cannot figure out how to configure the 
iptables rules
on the embedded board to achieve this.

I have tried to forward port 123 but it does not work.

Regards
Tobias

Re: NTP forwarding

[Pascal Hambourg]

Tobias Andresen a écrit :
> 
> i have following network structure:
> 
> 
>      NTP-Server (62.214.6.29)
>                |
>                |
>                |
>       (eth0: 10.0.0.95)
>         Embedded board
>     (eth1: 192.168.31.95)
>                |
>                |
>                |
>         Ethernet-Switch
>          |        |    |
>          |        |    |
>         PC1       |   PC3 (192.168.31.98)
> (192.168.31.96)  |
>                   |
>                  PC2
> (192.168.31.97)
> 
> 
> The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
> to update their time but i cannot figure out how to configure the 
> iptables rules
> on the embedded board to achieve this.

Why do you think you need iptables rules ? Isn't plain routing enough ?

> I have tried to forward port 123 but it does not work.

This statement does not contain any useful information. It does not
describe what you did and what happened.

Re: NTP forwarding

[Tobias Andresen]

Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
> Tobias Andresen a écrit :
>> i have following network structure:
>>
>>
>>       NTP-Server (62.214.6.29)
>>                 |
>>                 |
>>                 |
>>        (eth0: 10.0.0.95)
>>          Embedded board
>>      (eth1: 192.168.31.95)
>>                 |
>>                 |
>>                 |
>>          Ethernet-Switch
>>           |        |    |
>>           |        |    |
>>          PC1       |   PC3 (192.168.31.98)
>> (192.168.31.96)  |
>>                    |
>>                   PC2
>> (192.168.31.97)
>>
>>
>> The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
>> to update their time but i cannot figure out how to configure the
>> iptables rules
>> on the embedded board to achieve this.
> Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able 
tohave full access (i.e. internet, ...)
>
>> I have tried to forward port 123 but it does not work.
> This statement does not contain any useful information. It does not
> describe what you did and what happened.

I tried following rule for one PC:

iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT 
--to-destination 192.168.31.96:123
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE

I know this would work only for one client but it was for testing purposes.




> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: NTP forwarding

[Pascal Hambourg]

Tobias Andresen a écrit :
> Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
>> Why do you think you need iptables rules ? Isn't plain routing enough ?
>
> The PCs should only be able use NTP (Port 123). They should not be able 
> tohave full access (i.e. internet, ...)

Then you need filtering, not NAT.

> I tried following rule for one PC:
> 
> iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT 
> --to-destination 192.168.31.96:123

What is the purpose of this rule ? It redirects NTP packets to
192.168.31.96. How do you expect that NTP packets eventually reach
62.214.6.29 ?

> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE

Why is this rule needed ? What's between 10.0.0.95 and 62.214.6.29 ?

Re: NTP forwarding

[Remzi AKYÜZ]

Hi,

I am thinking this is enough f for you.

At Embedded board :

iptables  -A FORWARD -p udp --dport 123  -s 192.168.31.96/30 -j ACCEPT

iptables  -A FORWARD   -s 192.168.31.96/30 -j DROP

iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE

sysctl -w net.ipv6.conf.all.forwarding=1

After that please check your all ip tables rules like as;

iptables-save

iptables -L   -vnx --line-numbers

iptables -L -t nat  -vnx --line-numbers


03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
> Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
>> Tobias Andresen a écrit :
>>> i have following network structure:
>>>
>>>
>>>       NTP-Server (62.214.6.29)
>>>                 |
>>>                 |
>>>                 |
>>>        (eth0: 10.0.0.95)
>>>          Embedded board
>>>      (eth1: 192.168.31.95)
>>>                 |
>>>                 |
>>>                 |
>>>          Ethernet-Switch
>>>           |        |    |
>>>           |        |    |
>>>          PC1       |   PC3 (192.168.31.98)
>>> (192.168.31.96)  |
>>>                    |
>>>                   PC2
>>> (192.168.31.97)
>>>
>>>
>>> The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
>>> to update their time but i cannot figure out how to configure the
>>> iptables rules
>>> on the embedded board to achieve this.
>> Why do you think you need iptables rules ? Isn't plain routing enough ?
> The PCs should only be able use NTP (Port 123). They should not be
> able tohave full access (i.e. internet, ...)
>>
>>> I have tried to forward port 123 but it does not work.
>> This statement does not contain any useful information. It does not
>> describe what you did and what happened.
>
> I tried following rule for one PC:
>
> iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT
> --to-destination 192.168.31.96:123
> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>
> I know this would work only for one client but it was for testing
> purposes.
>
>
>
>
>> -- 
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: NTP forwarding

[Tobias Andresen]

Am 06.03.2016 um 22:40 schrieb Pascal Hambourg:
> Tobias Andresen a écrit :
>> Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
>>> Why do you think you need iptables rules ? Isn't plain routing enough ?
>> The PCs should only be able use NTP (Port 123). They should not be able
>> tohave full access (i.e. internet, ...)
> Then you need filtering, not NAT.
>
>> I tried following rule for one PC:
>>
>> iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT
>> --to-destination 192.168.31.96:123
> What is the purpose of this rule ? It redirects NTP packets to
> 192.168.31.96. How do you expect that NTP packets eventually reach
> 62.214.6.29 ?
>
>> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
> Why is this rule needed ? What's between 10.0.0.95 and 62.214.6.29 ?
This is the internet connection.

I cannot achieve this by using iptables or why would you prefer plain 
routing?
I thought i have to use iptables because the ntp server (62.214.6.29) 
does not know who is behind 10.0.0.95
and the embedded device has to change the source and destination address...

Re: NTP forwarding

[Tobias Andresen]

Am 07.03.2016 um 04:49 schrieb Remzi AKYÜZ:
> Hi,
>
> I am thinking this is enough f for you.
>
> At Embedded board :
>
> iptables  -A FORWARD -p udp --dport 123  -s 192.168.31.96/30 -j ACCEPT
>
> iptables  -A FORWARD   -s 192.168.31.96/30 -j DROP
>
> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>
> sysctl -w net.ipv6.conf.all.forwarding=1
>
> After that please check your all ip tables rules like as;
>
> iptables-save
>
> iptables -L   -vnx --line-numbers
>
> iptables -L -t nat  -vnx --line-numbers
  Thanks for your help but it seems not to work.


> 03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
>> Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
>>> Tobias Andresen a écrit :
>>>> i have following network structure:
>>>>
>>>>
>>>>        NTP-Server (62.214.6.29)
>>>>                  |
>>>>                  |
>>>>                  |
>>>>         (eth0: 10.0.0.95)
>>>>           Embedded board
>>>>       (eth1: 192.168.31.95)
>>>>                  |
>>>>                  |
>>>>                  |
>>>>           Ethernet-Switch
>>>>            |        |    |
>>>>            |        |    |
>>>>           PC1       |   PC3 (192.168.31.98)
>>>> (192.168.31.96)  |
>>>>                     |
>>>>                    PC2
>>>> (192.168.31.97)
>>>>
>>>>
>>>> The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
>>>> to update their time but i cannot figure out how to configure the
>>>> iptables rules
>>>> on the embedded board to achieve this.
>>> Why do you think you need iptables rules ? Isn't plain routing enough ?
>> The PCs should only be able use NTP (Port 123). They should not be
>> able tohave full access (i.e. internet, ...)
>>>> I have tried to forward port 123 but it does not work.
>>> This statement does not contain any useful information. It does not
>>> describe what you did and what happened.
>> I tried following rule for one PC:
>>
>> iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT
>> --to-destination 192.168.31.96:123
>> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>>
>> I know this would work only for one client but it was for testing
>> purposes.
>>
>>
>>
>>
>>> -- 
>>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>> -- 
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: NTP forwarding

[Vigneswaran R]

On 03/07/2016 12:56 PM, Tobias Andresen wrote:
> Am 07.03.2016 um 04:49 schrieb Remzi AKYÜZ:
>> Hi,
>>
>> I am thinking this is enough f for you.
>>
>> At Embedded board :
>>
>> iptables  -A FORWARD -p udp --dport 123  -s 192.168.31.96/30 -j ACCEPT
>>
>> iptables  -A FORWARD   -s 192.168.31.96/30 -j DROP
>>
>> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>>
>> sysctl -w net.ipv6.conf.all.forwarding=1
>>
>> After that please check your all ip tables rules like as;
>>
>> iptables-save
>>
>> iptables -L   -vnx --line-numbers
>>
>> iptables -L -t nat  -vnx --line-numbers
>  Thanks for your help but it seems not to work.

Please try the following commands too (besides the above ones).

At Embedded board: (enable ipv4 forwarding)

     sysctl -w net.ipv4.conf.all.forwarding=1

At the PCs: (set default gateway, if not done already)

     ip route add default via 192.168.31.95


Vignesh

>
>
>> 03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
>>> Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
>>>> Tobias Andresen a écrit :
>>>>> i have following network structure:
>>>>>
>>>>>
>>>>>        NTP-Server (62.214.6.29)
>>>>>                  |
>>>>>                  |
>>>>>                  |
>>>>>         (eth0: 10.0.0.95)
>>>>>           Embedded board
>>>>>       (eth1: 192.168.31.95)
>>>>>                  |
>>>>>                  |
>>>>>                  |
>>>>>           Ethernet-Switch
>>>>>            |        |    |
>>>>>            |        |    |
>>>>>           PC1       |   PC3 (192.168.31.98)
>>>>> (192.168.31.96)  |
>>>>>                     |
>>>>>                    PC2
>>>>> (192.168.31.97)
>>>>>
>>>>>
>>>>> The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
>>>>> to update their time but i cannot figure out how to configure the
>>>>> iptables rules
>>>>> on the embedded board to achieve this.
>>>> Why do you think you need iptables rules ? Isn't plain routing 
>>>> enough ?
>>> The PCs should only be able use NTP (Port 123). They should not be
>>> able tohave full access (i.e. internet, ...)
>>>>> I have tried to forward port 123 but it does not work.
>>>> This statement does not contain any useful information. It does not
>>>> describe what you did and what happened.
>>> I tried following rule for one PC:
>>>
>>> iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT
>>> --to-destination 192.168.31.96:123
>>> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>>>
>>> I know this would work only for one client but it was for testing
>>> purposes.
>>>
>>>
>>>
>>>
>>>> -- 
>>>> To unsubscribe from this list: send the line "unsubscribe 
>>>> netfilter" in
>>>> the body of a message to majordomo@vger.kernel.org
>>>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>> -- 
>>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: NTP forwarding

[Remzi AKYÜZ]

sysctl -w net.ipv6.conf.all.forwarding=1  should be  sysctl -w
net.ipv4.conf.all.forwarding=1

After sysctl -w net.ipv4.conf.all.forwarding=1  it should work. It is
not work, check your all rules and route.


03/07/2016 09:26 AM tarihinde Tobias Andresen yazdı:
> Am 07.03.2016 um 04:49 schrieb Remzi AKYÜZ:
>> Hi,
>>
>> I am thinking this is enough f for you.
>>
>> At Embedded board :
>>
>> iptables  -A FORWARD -p udp --dport 123  -s 192.168.31.96/30 -j ACCEPT
>>
>> iptables  -A FORWARD   -s 192.168.31.96/30 -j DROP
>>
>> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>>
>> sysctl -w net.ipv6.conf.all.forwarding=1
>>
>> After that please check your all ip tables rules like as;
>>
>> iptables-save
>>
>> iptables -L   -vnx --line-numbers
>>
>> iptables -L -t nat  -vnx --line-numbers
>  Thanks for your help but it seems not to work.
>
>
>> 03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
>>> Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
>>>> Tobias Andresen a écrit :
>>>>> i have following network structure:
>>>>>
>>>>>
>>>>>        NTP-Server (62.214.6.29)
>>>>>                  |
>>>>>                  |
>>>>>                  |
>>>>>         (eth0: 10.0.0.95)
>>>>>           Embedded board
>>>>>       (eth1: 192.168.31.95)
>>>>>                  |
>>>>>                  |
>>>>>                  |
>>>>>           Ethernet-Switch
>>>>>            |        |    |
>>>>>            |        |    |
>>>>>           PC1       |   PC3 (192.168.31.98)
>>>>> (192.168.31.96)  |
>>>>>                     |
>>>>>                    PC2
>>>>> (192.168.31.97)
>>>>>
>>>>>
>>>>> The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
>>>>> to update their time but i cannot figure out how to configure the
>>>>> iptables rules
>>>>> on the embedded board to achieve this.
>>>> Why do you think you need iptables rules ? Isn't plain routing
>>>> enough ?
>>> The PCs should only be able use NTP (Port 123). They should not be
>>> able tohave full access (i.e. internet, ...)
>>>>> I have tried to forward port 123 but it does not work.
>>>> This statement does not contain any useful information. It does not
>>>> describe what you did and what happened.
>>> I tried following rule for one PC:
>>>
>>> iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT
>>> --to-destination 192.168.31.96:123
>>> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>>>
>>> I know this would work only for one client but it was for testing
>>> purposes.
>>>
>>>
>>>
>>>
>>>> -- 
>>>> To unsubscribe from this list: send the line "unsubscribe
>>>> netfilter" in
>>>> the body of a message to majordomo@vger.kernel.org
>>>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>> -- 
>>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: NTP forwarding

[Pascal Hambourg]

Tobias Andresen a écrit :
> Am 06.03.2016 um 22:40 schrieb Pascal Hambourg:
>>
>>> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>>
>> Why is this rule needed ? What's between 10.0.0.95 and 62.214.6.29 ?
>
> This is the internet connection.

But I suppose it is not a simple wire. 10.0.0.95 is a private address
and 62.214.6.29 is a public IP address, so there must be some sort of
NAT router between them. Am I correct ?

> I cannot achieve this by using iptables or why would you prefer plain 
> routing?

Because the action of carrying packets from the source to the
destination is done by routing.

> I thought i have to use iptables because the ntp server (62.214.6.29) 
> does not know who is behind 10.0.0.95
> and the embedded device has to change the source and destination address...

Why ? IIUC 62.214.6.29 is a public address on the internet and 10.0.0.95
is a private address on your LAN, so the NTP server does not know about
10.0.0.95 either. The job of changing private addresses must be
performed by some other device connected to the same network as eth0.
Only that device needs to know about your private addresses.

Re: NTP forwarding

[Karol Babioch]

[-- Attachment #1.1: Type: text/plain, Size: 297 bytes --]

Hi,

Am 05.03.2016 um 15:15 schrieb Tobias Andresen:
> I have tried to forward port 123 but it does not work.

Regardless of whether you can make the forwarding work or not, maybe it
would be a better idea to run your own NTP server on the embedded board?

Best regards,
Karol Babioch


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]