Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.protocols.time.ntp > #6347

Re: IPv6 and ip6tables

Show all headers | View raw

On Monday, March 11, 2013 10:13:28 PM UTC+1, Ivan Shmakov wrote:
> 	I've never seen an issue with such a setup.  The only difference
> 	is that my firewall has also a -j ACCEPT rule for --dport 123 in
> 	the FORWARD chain.  I don't know if it's related, though.

I tried to add ACCEPT rules on the FORWARD chain for port 123, and when nothing changed I switched the policy to ACCEPT. NTP server was still unreachable. Reverted back.


> 	Is there really such an all-permitting rule?

In fact it is for loopback only (-A INPUT -i lo -j ACCEPT) but for some reason -L doesn't show that.


I decided to perform some logging of the dropped packets.

> sudo ip6tables -N LOGGING
> sudo ip6tables -A LOGGING -j LOG --log-prefix "IPTables-Dropped: " --log-level 7
> sudo ip6tables -A LOGGING -j DROP
> sudo ip6tables -A INPUT -i eth0 -j LOGGING

Only a few lines popped up in my log, all of them being PROTO=ICMPv6 TYPE=135 or TYPE=136, that is neighbor advertisements and solicitations. They were not specifically printed at the same time than the NTP request. I tried to allow them nonetheless:

> sudo ip6tables -D INPUT -i eth0 -j LOGGING
> sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
> sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT

Now my NTP server is reachable!

I don't know if it is related with my provider's network architecture (I have a VPS server hosted by gandi.net) or if it is the common behaviour of NTP over IPv6. I should note I've already had ICMPv6-related issues in the past: I had to turn on router-solicitation and router-advertisement to get a global ipv6 address at all. What should be enabled is still a bit arcane to me.

Anyway, everything looks fine now!

Cheers,
Xavier

Back to comp.protocols.time.ntp | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-11 02:10 -0700
  Re: IPv6 and ip6tables Ivan Shmakov <oneingray@gmail.com> - 2013-03-11 21:13 +0000
    Re: IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-12 08:50 -0700
      Re: IPv6 and ip6tables Rob <nomail@example.com> - 2013-03-12 16:50 +0000
        Re: IPv6 and ip6tables "Alexandre Y. Harano" <harano@nic.br> - 2013-03-12 17:54 +0000
          Re: IPv6 and ip6tables Rob <nomail@example.com> - 2013-03-13 13:28 +0000
            Re: IPv6 and ip6tables David Woolley <david@ex.djwhome.demon.invalid> - 2013-03-14 07:58 +0000
        Re: IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-14 07:08 -0700

csiph-web