Re: NTP forwarding

["Remzi AKYÜZ" <linuxliste@gmail.com>]

Hi,

I am thinking this is enough f for you.

At Embedded board :

iptables  -A FORWARD -p udp --dport 123  -s 192.168.31.96/30 -j ACCEPT

iptables  -A FORWARD   -s 192.168.31.96/30 -j DROP

iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE

sysctl -w net.ipv6.conf.all.forwarding=1

After that please check your all ip tables rules like as;

iptables-save

iptables -L   -vnx --line-numbers

iptables -L -t nat  -vnx --line-numbers


03/06/2016 11:16 PM tarihinde Tobias Andresen yazdı:
> Am 06.03.2016 um 21:42 schrieb Pascal Hambourg:
>> Tobias Andresen a écrit :
>>> i have following network structure:
>>>
>>>
>>>       NTP-Server (62.214.6.29)
>>>                 |
>>>                 |
>>>                 |
>>>        (eth0: 10.0.0.95)
>>>          Embedded board
>>>      (eth1: 192.168.31.95)
>>>                 |
>>>                 |
>>>                 |
>>>          Ethernet-Switch
>>>           |        |    |
>>>           |        |    |
>>>          PC1       |   PC3 (192.168.31.98)
>>> (192.168.31.96)  |
>>>                    |
>>>                   PC2
>>> (192.168.31.97)
>>>
>>>
>>> The 3 PCs shall be able to connect to the NTP server (62.214.6.29)
>>> to update their time but i cannot figure out how to configure the
>>> iptables rules
>>> on the embedded board to achieve this.
>> Why do you think you need iptables rules ? Isn't plain routing enough ?
> The PCs should only be able use NTP (Port 123). They should not be
> able tohave full access (i.e. internet, ...)
>>
>>> I have tried to forward port 123 but it does not work.
>> This statement does not contain any useful information. It does not
>> describe what you did and what happened.
>
> I tried following rule for one PC:
>
> iptables -t nat -A PREROUTING -p udp --dport 123 -j DNAT
> --to-destination 192.168.31.96:123
> iptables -t nat -A POSTROUTING -p udp --dport 123 -j MASQUERADE
>
> I know this would work only for one client but it was for testing
> purposes.
>
>
>
>
>> -- 
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html