Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a rehash of another question, now that I understand things a bit better.

I have the following network set up:

    |     \______________
    |                    \ (eth1)     |   
   L1                    | (eth0)       |
    |                    |
    |                    | (pcn1)       |
   OpenBSD               | (pcn0)       |
    |                    |
    |                    | (eth1) (eth0)

Where L1 and L2 are Linux boxes.

I would like the OpenBSD box to be able to get the time from the NTP server. I have been told that to achieve this I need to make some changes to the OpenBSD box's /etc/pf.conf file.

My initial attempt is as follows. I know I will also need to make some changes to iptables on the Linux box, but for the moment tcpdump udp on the Linux box doesn't show any traffic coming through from the OpenBSD box, I'm assuming that the NTP client's request isn't being properly routed to the Linux box.

rdr on pcn1  proto udp from any to any port 123 ->
nat on pcn0 proto udp from any to port 123 -> pcn1

I am updating the OpenBSD box's configuration with the following command:

pfctl -F all ; pfctl -f /etc/pf.conf

And I am doing the ntp update with the following command to see what happens:

ntpd -d -s

I am using 'traditional' ntp, not OpenNTP.

What do I need to change in pf.conf to see UDP packets arriving on L1? Just to reiterate, the PF configuration is on the same machine that I will be running the ntpd client on.

share|improve this question
up vote 0 down vote accepted

Ok, I've got it working. First of all, the pf configuration is:

rdr on pcn0    proto udp from any to any port 123 ->
nat on pcn0 proto udp from any to port 123 -> pcn1

But also, I had configured my ntp client to connect to, and in fact it should be connecting to

I now need to configure the machine listening at to forward NTP requests on to, but that's a subject for another question! :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.