diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2020-11-05 17:13:03 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2020-11-15 18:33:37 +0100 |
| commit | e8e01842f4e578ec427dd8d6f5a5e40b498458af (patch) | |
| tree | b4fcd836afa59a11570d54ab2e55dceb99e98bfc /roles/common/templates/etc/nftables.conf.j2 | |
| parent | 6a7bf972fa2c054f1aef5465237343247959e313 (diff) | |
Change NTP client to systemd-timesyncd.
(Excluding our NTP master.) It's simpler, arguably more secure, and
provides enough functionality when only simple client use-cases are
desired.
We allow outgoing connections to 123/udp also on NTP slaves so systemd-timesyncd
can connect to the fallbacks NTP servers.
Diffstat (limited to 'roles/common/templates/etc/nftables.conf.j2')
| -rwxr-xr-x | roles/common/templates/etc/nftables.conf.j2 | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/roles/common/templates/etc/nftables.conf.j2 b/roles/common/templates/etc/nftables.conf.j2 index c89a136..808383c 100755 --- a/roles/common/templates/etc/nftables.conf.j2 +++ b/roles/common/templates/etc/nftables.conf.j2 @@ -168,7 +168,9 @@ table inet filter { # incoming ICMP/ICMPv6 traffic was filtered in the ingress chain already meta l4proto { icmp, icmpv6 } counter accept - udp sport 123 udp dport 123 ct state related,established accept + # NTP (ntpd uses sport 123 but systemd-timesyncd does not) + udp sport 123 ct state related,established accept + {% if groups.all | length > 1 %} udp sport 500 udp dport 500 ct state new,related,established accept {% if groups.NATed | length > 0 %} @@ -206,7 +208,9 @@ table inet filter { meta l4proto { icmp, icmpv6 } counter accept - udp sport 123 udp dport 123 ct state new,related,established accept + # NTP (ntpd uses sport 123 but systemd-timesyncd does not) + udp dport 123 ct state new,related,established accept + {% if groups.all | length > 1 %} udp sport 500 udp dport 500 ct state new,related,established accept {% if groups.NATed | length > 0 %} |