Re: transparent proxying NTP

[Dimitar Katerinski <train@bofh.bg>]

Folkert van Heusden wrote:

 > Hi,
 >
 > I'm trying to do transparent proxying for NTP.
 > I want to do that as some access points I have over here want to sync their
 > time to some server in Amerika. Not so efficient as I live in europe and
 > have in fact my own local stratum 1 timeserver.
 > So, I tried this:
 > iptables -t nat -A PREROUTING -i eth1 -s ! 192.168.64.1 -p udp --dport 123 -j DNAT --to 192.168.64.1:123
 > iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.0/16 -d 192.168.64.1 -j SNAT --to 127.0.0.1
 >
 > But when I do a tcpdump on ppp0 of my gateway (the adsl connection) and do
 > netdate ntp.xs4all.nl from a host on my lan (192.168.64.99), I still see
 > requests coming from that host to the internet!
 > I guess I'm doing something obvious wrong here but I'm not sure what.
 > Could someone please enlighten me?
 >
 >
 > Folkert van Heusden



Hello,

Well if you think how transparent www proxy works, you may figure out how to do transparent ntp proxying.
The following rule should do the job:
iptables -t nat -A PREROUTING -i eth1 -s $LAN_SUBNET -p udp --dport 123 -j REDIRECT --to-ports 123
also I think
iptables -t nat -A PREROUTING -i eth1 -s $LAN_SUBNET -p udp --dport 123 -j DNAT --to-destination 192.168.64.1:124
might work, as I test it. You dont need the SNAT rule though. Test these and give feedback.


P.S. Sorry for sending this message right to you, my mistake.

Regards,
Dimitar

-- 
"The only thing necessary for the triumph of evil is for good men to do nothing."
                                                   --Edmund Burke.