For my residential service, I changed ISPs to Zoom/Armstrong. Just after that, my NTP daemons stopped working. I dug deep and diagnosed the problem:

Unprivileged ports are getting out. When i run 'ntpdate' for example, I go out on a high, unprivleged port, and get a response on UDP 123. That's fine. The 'ntpd' daemon though, expects to go out on 123 and get its reply there as well. This must be a common problem, because it's directly addressed in the NTP troubleshooting guide.

Just to see what would happen, I wrote a detailed email to the general support address at Armstrong. They replied almost immediately with a complete technical answer! They have everything <1024 blocked, except for a few ports to support outbound VPN.

So, the question:

Can I use IPtables to essentially re-write my outbound UDP 123 up to 2123 or something like that? If I do, does there need to be a corresponding 2123->123 rule to translate the reply? This seems like NAT, but with ports, not addresses. I tried, but can't seem to get iptables to do what I want. I'm not sure if it's my lack of skill, or if I'm trying the wrong solution.

True, I could run ntpdate from cron, but that loses all of the adjustment smarts of NTP.


Try this rule (untested):

iptables -t nat -A POSTROUTING -p udp --sport 123 -j MASQUERADE --to-ports 1025-65535
| improve this answer | |
  • +1. Also, -j SNAT --to local_ip:port is possible here for non-dynamic IPs – Sam Halicke Jun 13 '10 at 7:37

You can probably do that with the mangle table, but more normally why not use the state module? I think this is kind of the standard iptables config that has the following rule:

ACCEPT     all  --  anywhere    anywhere     state RELATED,ESTABLISHED

This way holes will get punched in the firewall for return traffic...

Oh, I missed that is your ISP blocking, well that is just a crap ISP, keeping this answer up in case it helps someone else who finds this question with a similar issue, but not your particular one.

| improve this answer | |
  • The problem is that the link says that NTP counts on the replies going to 123, so any sort of nat/mangle rule on your end won't help because the ISP will block it before then. – Kyle Brandt Apr 20 '10 at 12:35
  • I think it's just outbound. ntpdate goes out high, comes back on 123 and works. It's just my egress on 123 that seems to be blocked. – pboin Apr 20 '10 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.