Configure iptables: Allow NTP Time Synchronization Internet Access while Blocking Everything Else in LAN
In this article, we will discuss how to configure iptables to allow Network Time Protocol (NTP) time synchronization internet access for machines in a Local Area Network (LAN), while blocking everything else. This is useful in scenarios where you want to ensure that the machines in your network have the correct time, but you do not want to allow any other internet access. We will cover the key concepts and provide detailed context on the topic. The subtitles below will guide you through the process.
Prerequisites
Before we begin, it is assumed that you have a basic understanding of Linux and iptables. Additionally, you should have root access to the machine where you will be implementing these changes. It is also recommended to have a backup of your current iptables rules before making any changes.
What is iptables?
Iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, implemented as different Netfilter modules. The filters are organized in different tables, which contain chains of rules for how to treat network traffic packets.
Blocking Everything Except NTP
To block everything except NTP, we need to create a new chain and add rules to it. The following script can be used as a starting point:
# Reset
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Allow NTP
iptables -A INPUT -p udp --dport 123 -j ACCEPT
# Block everything else
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP
This script first resets all current iptables rules, then allows NTP traffic on UDP port 123, and finally blocks all other incoming and forwarded traffic.
Testing Your Configuration
After implementing the above rules, you can test if NTP is working by running the following command:
ntpdate -q pool.ntp.org
This command will query the NTP server at pool.ntp.org and display the current time. If the time is displayed correctly, then your configuration is working as intended.
In this article, we have discussed how to configure iptables to allow NTP time synchronization internet access for machines in a LAN, while blocking everything else. We have covered the key concepts and provided detailed context on the topic. We have also provided a script that can be used as a starting point for implementing these changes.
References
- Man page for iptables
- Man page for ntpdate
- Network Time Protocol (NTP) official website