Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am new to IPTables. I have an existing config that seems to work well. I am not sure I know how to add NTP to the rule Chain RH-Firewall-1-INPUT correctly. My goal is to add an additional rule to allow NTP to enter the server so it can act as a NTP server for my network. Would I simply need iptables -I RH-Firewall-1-INPUT -p udp --dport 123 -j ACCEPT and then of course if it works iptables save I'm not confident whether I should be using -I Insert or -A Append, or if it is much more difficult. Below is my existing config shown with iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:squid
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
share|improve this question
    
The first line of RH-Firewall-1-INPUT is allowing all traffic of any protocol to come in. With that said, you shouldn't have to modify your ruleset to get NTP working –  Creek Apr 24 at 15:50

1 Answer 1

up vote 0 down vote accepted

Considering your last rule is an unconditional REJECT I would do it with a -I since appending it would create a rule that would never be reached. ntpd only communicates over udp/123 so allowing that traffic and RELATED,ESTABLISHED is often good enough on its own.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.