Re: NTP forwarding

[Tobias Andresen <tobiasarp@gmx.de>]

Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
> Tobias Andresen a écrit :
>> i have following network structure:
>>
>>
>>       NTP-Server (62.214.6.29)
>>                 |
>>                 |
>>                 |
>>        (eth0: 10.0.0.95)
>>          Embedded board
>>      (eth1: 192.168.31.95)
>>                 |
>>                 |
>>                 |
>>          Ethernet-Switch
>>           |        |    |
>>           |        |    |
>>          PC1       |   PC3 (192.168.31.98)
>> (192.168.31.96)  |
>>                    |
>>                   PC2
>> (192.168.31.97)
>>
>>
>> The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
>> to update their time but i cannot figure out how to configure the
>> iptables rules
>> on the embedded board to achieve this.
> Why do you think you need iptables rules ? Isn't plain routing enough ?
The PCs should only be able use NTP (Port 123). They should not be able 
tohave full access (i.e. internet, ...)
>
>> I have tried to forward port 123 but it does not work.
> This statement does not contain any useful information. It does not
> describe what you did and what happened.

I tried following rule for one PC:

iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT 
--to-destination 192.168.31.96:123
iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE

I know this would work only for one client but it was for testing purposes.




> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html