11

I've enabled UFW on one of production servers with configuration: Default: deny (incoming), deny (outgoing). For NTP synchronization, I've installed ntp and it's currently running.

Can someone advise what rule should be added to UFW for NTP synchronization? I've read somewhere that udp port 123 needs to be open for ntp, but when I run ntpq -p, I get following output:

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 propjet.latt.ne 187.253.153.32   2 u   4d 1024    0   81.243    9.054   0.000
 ec2-107-20-168- 130.207.244.240  2 u   4d 1024    0   86.669  -23.040   0.000
 utcnist2.colora .ACTS.           1 u   4d 1024    0  298.151   86.936   0.000

which indicates that I don't need to add any ufw rule and ntp is already working?

5
  • Why deny outgoing?
    – A.B.
    Dec 15 '15 at 17:13
  • Just for extra security. Actually I've another server which was comprised with some trojan(s) and we controlled it by denying outgoing for the time being. Dec 16 '15 at 5:37
  • 2
    Deny outgoing is no extra security. Clean your infected system. That's extra security.
    – A.B.
    Dec 24 '15 at 10:56
  • I was talking about two different servers! Extra security was meant for non-compromised server. Dec 24 '15 at 16:05
  • Maybe read the NTP FAQ to learn what reach 0 actually means: You are not receiving NTP packets!
    – U. Windl
    Aug 3 at 12:23
14

With a simple

sudo ufw allow ntp 

You can use all services listed in /etc/services

sudo ufw allow <service name>
4
  • 1
    Thanks! But as I mentioned in my post without allowing ntp , I am still getting proper response of ntpq -p, what might be the reason? Dec 16 '15 at 5:34
  • Allowing ntp for incoming traffic is not enough in my case. As I mentioned in the question, default outgoing traffic is blocked, so I've allowed UDP 123 for both incoming and outgoing traffic to ntp work. Dec 24 '15 at 9:06
  • Read your own comment "and we controlled it by denying outgoing for the time being."
    – A.B.
    Dec 24 '15 at 10:57
  • I was talking about two different servers. Please have a look at my question and comments again. Thanks Dec 24 '15 at 16:09
1

With the following rules-set, NTP-synchronization is working perfectly for me:

sudo ufw allow 123/udp
sudo ufw allow out 123/udp
sudo ufw allow out 53

I've allowed UDP port 123 for both incoming and outgoing traffic to NTP work. Additionally I also needed to open TCP port 53 (DNS) for outgoing traffic since /etc/ntp.conf contains domain names of NTP servers. .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.