l i n u x - u s e r s - g r o u p - o f - d a v i s
L U G O D
 
Next Meeting:
November 4: Social gathering
Next Installfest:
TBD
Latest News:
Oct. 10: LUGOD Installfests coming again soon
Page last updated:
2002 Feb 24 01:07

The following is an archive of a post made to our 'vox-tech mailing list' by one of its subscribers.

Report this post as spam:

(Enter your email address)
Re: [vox-tech] Clock drift bad, HULK SMASH!
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [vox-tech] Clock drift bad, HULK SMASH!



On Sat, 23 Feb 2002, Bill Broadley wrote:

> On Wed, Feb 20, 2002 at 05:18:44PM -0800, Ryan wrote:
> > I can't get NTP at school, and at home I'm running Mandrake's firewall 
> > package, which I can't figure out how to get ntp through.
> 
> I'm not really familar with mandrak, but usually something like:
> ipchains -A inet_in -s remote.ntp.host 123 -d 0.0.0.0/0 123 -p UDP -j ACCEPT
> 
> Will work.

Something like that, but there are gotchas.

1) the -A option _appends_ to the chain.  If the chain terminates with
default denys (to enable logging of unspecified connection attempts, for
example) then this rule would never get invoked.  Generally if this is the
case, you should be editing a configuration file to get the rule into the
body of the ruleset and re-load the entire fireall ruleset.

2) the "inet_in" chain is a convention thing... I don't know which
firewall he started with, and different people use different chain names,
so this chain may not be active in the current firewall.

3) this rule only handles inbound packets... would need another rule to
handle outbound packets, or use the "-b" option as shorthand for
"bidirectional".

4) it is a good idea to disallow inbound connection initiation packets
with the "! -y" option on the inbound rule.  this precludes the use of the
"-b" option, since you would not want this restriction on outbound
packets.

5) if you are running kernel 2.4 you could be using iptables, in which
stateful connection management can apply more detailed validation than the
simple "no inbound SYN" described in (4), but I don't know any details
since I am not running 2.4.

---------------------------------------------------------------------------
Jeff Newmiller                        The     .....       .....  Go Live...
DCN:<jdnewmil@dcn.davis.ca.us>        Basics: ##.#.       ##.#.  Live Go...
                                      Live:   OO#.. Dead: OO#..  Playing
Research Engineer (Solar/Batteries            O.O#.       #.O#.  with
/Software/Embedded Controllers)               .OO#.       .OO#.  rocks...2k
---------------------------------------------------------------------------

_______________________________________________
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech



LinkedIn
LUGOD Group on LinkedIn
Sign up for LUGOD event announcements
Your email address:
facebook
LUGOD Group on Facebook
'Like' LUGOD on Facebook:

Hosting provided by:
Sunset Systems
Sunset Systems offers preconfigured Linux systems, remote system administration and custom software development.

LUGOD: Linux Users' Group of Davis
PO Box 2082, Davis, CA 95617
Contact Us

LUGOD is a 501(c)7 non-profit organization
based in Davis, California
and serving the Sacramento area.
"Linux" is a trademark of Linus Torvalds.

Sponsored in part by:
Appahost Applications
For a significant contribution towards our projector, and a generous donation to allow us to continue meeting at the Davis Library.