From f5a0901ed4205e4675ec69a138b958be512a3211 Mon Sep 17 00:00:00 2001 From: Mark Wooding Date: Sun, 13 Jan 2013 19:15:18 +0000 Subject: [PATCH] ibanez.m4, vampire.m4: Provide NTP service to untrusted hosts. --- ibanez.m4 | 8 ++++++++ vampire.m4 | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/ibanez.m4 b/ibanez.m4 index 6769b05..334ba03 100644 --- a/ibanez.m4 +++ b/ibanez.m4 @@ -33,5 +33,13 @@ allowservices inbound tcp \ ## We have to provide NTP service. The guests sync to our clock. ntpclient inbound $ntp_servers +## Provide NTP service to untrusted clients. +iptables -A inbound -p udp -j ACCEPT \ + --source-port 123 --destination-port 123 \ + -s 172.29.198.0/23 +ip6tables -A inbound -p udp -j ACCEPT \ + --source-port 123 --destination-port 123 \ + -s 2001:470:9740::/48 + m4_divert(-1) ###----- That's all, folks -------------------------------------------------- diff --git a/vampire.m4 b/vampire.m4 index 34d5fde..e016358 100644 --- a/vampire.m4 +++ b/vampire.m4 @@ -70,5 +70,13 @@ dnsresolver inbound dnsserver inbound ntpclient inbound $ntp_servers +## Provide NTP service to untrusted clients. +iptables -A inbound -p udp -j ACCEPT \ + --source-port 123 --destination-port 123 \ + -s 172.29.198.0/23 +ip6tables -A inbound -p udp -j ACCEPT \ + --source-port 123 --destination-port 123 \ + -s 2001:470:9740::/48 + m4_divert(-1) ###----- That's all, folks -------------------------------------------------- -- 2.11.0