Subject: xntpd udp relay

From: Scott McEachern <[email-masked]>
Date: Wed, 14 Jun 2000 05:01:20 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

    Just a quick question here:
    I'm running xntpd on my firewall box, and my boss wants it off and
running on an internal machine.
    As far as I know, xntpd uses udp and the toolkit doesn't relay udp
at all, thus the xntpd _must_ run on the firewall machine.
    Is there _any_ way to get around this?

    Actually, while I'm thinking about it, something similar applies to
nameservers.  I have dns running on the f/w too.  How would our ISP do
zone transfers off an internal machine (hosting our external domain.)
    I'm quite puzzled by this, as I understand you shouldn't be running
any services like these on the f/w, but I don't see any way around it.
I asked this some months ago when I was less familiar with how things
work, and I was told that xntpd and dns must run on the f/w, but my boss
really _insists_ they do not, but is unable to explain how.

    Any help would be appreciated.

--
R. Scott McEachern, Network Administrator
J&A Media Services, Inc.,
300 John St., Suite 500
Thornhill, ON, CA.  L3T 5W4
tel: 905-881-6902  fax: 905-881-6945

---

From: Ted Keller <[email-masked]>
Date: Wed, 14 Jun 2000 09:16:24 -0400 (EDT)

Scott,

ntpd uses both tcp and udp.  So you are right - with the firewall by
itself, you can't pass these packets through to an internal server.

However, you may want to ask yourself a couple of questions....
1. why am I running it?

2. where do I get my time source from?

As for the first question, ntpd runs in two modes - that as a client (I go
and get the time and set my clock functions accordingly) and as a server
(I will tell someone else the time if they ask for it).

If accurate time on the firewall is important to you, then you have to run
at least the client on the firewall machine - otherwise the firewall
machine's clock will drift.  If I use the Internet as the time source and
want to sync my internal network, then the firewall will also have to be a
server in addition.  Now, with the ntp.conf file, you can at least specify
who can ask you for time.

On the second question, where do I get my time from?  Consider acquiring
an internal time source (GPS system or equivalent).  They are relatively
inexpensive and help solve the problem of trusting internet sources for
this function. Also, it helps solve the issue of passing these type of
packets across your firewall.  Your internal network can use the trusted
time source.  Your firewall, if you desire, can also point to that source.
Everything can operate in "client mode".

ted keller