Business Application Rule - must select an IP Range for Protected Server(s) / dnat ntp

You appear to have server on your LAN, why don't you make that your DHCP server and use an option to point the NTP calls at your NTP server rather than complex firewall rules?

Hi rfcat_vk,

I will explore the DHCP option but also want to use the firewall to avoid users from bypassing those DHCP options. Personally I don't see this as being a complex firewall rule as its simply a PREROUTING DNAT for UDP 123 using POSTROUTING MASQUERADE  (i.e. two lines in iptables). I've also opened an support case to inquiry if this the "must select an IP range for protected server" is a known bug.

Thanks.

You can block all users except your server from using 123 outgoing.

You actions would be even easier if the XG had an NTP proxy function like the UTM.

Hi Ian, the DHCP server NTP option doesn't work for all clients. What he is trying to do is trivial in UTM9 and is needed for hard coded devices like roku etc that want to get NTP time directly from the internet. In UTM9 you can setup a DNAT rule as follows

DNAT > Source Internal Network > Service NTP> Destination INTERNET (0.0.0.0) DNAT to Internal Interface IP of your firewall (since UTM has a built in NTP server) or IP of local NTP server.

In XG, there is no built in definition for ANY or INTERNET (0.0.0.0) so you have to define an IP range that will cover all IPs like 0.0.0.1 to 255.255.255.254. But when you do that, XG says you can't forward traffic for range of IPs to a single host.

The idea is basically taken from this post by  https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/80501/how-to-replicate-utm-rule-to-redirect-dns-ntp-to-internal-server/306949#306949 

Hi Ian, the DHCP server NTP option doesn't work for all clients. What he is trying to do is trivial in UTM9 and is needed for hard coded devices like roku etc that want to get NTP time directly from the internet. In UTM9 you can setup a DNAT rule as follows

DNAT > Source Internal Network > Service NTP> Destination INTERNET (0.0.0.0) DNAT to Internal Interface IP of your firewall (since UTM has a built in NTP server) or IP of local NTP server.

In XG, there is no built in definition for ANY or INTERNET (0.0.0.0) so you have to define an IP range that will cover all IPs like 0.0.0.1 to 255.255.255.254. But when you do that, XG says you can't forward traffic for range of IPs to a single host.

The idea is basically taken from this post by  https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/80501/how-to-replicate-utm-rule-to-redirect-dns-ntp-to-internal-server/306949#306949