Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.protocols.time.ntp > #6346

Re: IPv6 and ip6tables

Cross-posted to 2 groups.

Show all headers | View raw

>>>>> Xavier Robin <geckolimo@gmail.com> writes:

	[Cross-posting to news:comp.os.linux.networking.]

 > Has anyone some experience serving NTP over IPv6 through an ip6tables
 > firewall here?

 > Despite the fact that I opened port 123 (both UPD and TCP), as soon
 > as I set the INPUT policy to DROP, NTP becomes unreachable.  Is it
 > using a different port on ipv6 or something like this?  The server is
 > fully reachable when the INPUT policy is ACCEPT.  It is also
 > reachable over ipv4 with the same iptables rule (and DROP policy).

	I've never seen an issue with such a setup.  The only difference
	is that my firewall has also a -j ACCEPT rule for --dport 123 in
	the FORWARD chain.  I don't know if it's related, though.

[...]

 > xavier@arthur:~$ sudo ip6tables -L
 > [sudo] password for xavier: 
 > Chain INPUT (policy DROP)
 > target     prot opt source               destination         
 > ACCEPT     all      anywhere             anywhere            

	Is there really such an all-permitting rule?

 > ACCEPT     all      anywhere             anywhere             ctstate RELATED,ESTABLISHED
 > ACCEPT     tcp      anywhere             anywhere             tcp dpt:(some ports...)
 > ACCEPT     udp      anywhere             anywhere             udp dpt:ntp
 > ACCEPT     tcp      anywhere             anywhere             tcp dpt:ntp

[...]

-- 
FSF associate member #7257

Back to comp.protocols.time.ntp | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-11 02:10 -0700
  Re: IPv6 and ip6tables Ivan Shmakov <oneingray@gmail.com> - 2013-03-11 21:13 +0000
    Re: IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-12 08:50 -0700
      Re: IPv6 and ip6tables Rob <nomail@example.com> - 2013-03-12 16:50 +0000
        Re: IPv6 and ip6tables "Alexandre Y. Harano" <harano@nic.br> - 2013-03-12 17:54 +0000
          Re: IPv6 and ip6tables Rob <nomail@example.com> - 2013-03-13 13:28 +0000
            Re: IPv6 and ip6tables David Woolley <david@ex.djwhome.demon.invalid> - 2013-03-14 07:58 +0000
        Re: IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-14 07:08 -0700

csiph-web