[ale] NTP and 'ipchains'

[dmcnash at charter.net (Doug McNash)]

If you have a rule using connection tracking ($IPTABLES -A allowed -p
TCP -m state --state ESTABLISHED,RELATED -j ACCEPT) then responses are
allowed to connection initiated from the inside.

But,alas, udp is connectionless so you need the explicit rule.

On Sat, 2004-01-17 at 16:10, John Mills wrote:
> ALErs -
> 
> I'm running RH-7.3 and 'ipchains'. My LAN sits behind a firewall/router
> that forwards only port 22 to serve incoming SSH. In order for 'ntpdate'
> to successfully connect to outside servers, I had to add an 'ipchains'
> rule:
>  -A input -s 0/0 -d 0/0 123 -p udp -j ACCEPT
> 
> I didn't have to forward this port back through the router/firewall, 
> however.
> 
> Was it normal to need such a rule when I don't need rules to pass other
> sorts of replies, such as responses to telnet and http inquiries to other
> hosts?
> 
> Thanks for any background on this.
> 
>  - John Mills
>    john.m.mills at alum.mit.edu
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
-- 
doug mcnash