Subject: [Ntp] Fw: NTS Hackathon coordination

From: "Gary E. Miller" <[email-masked]>
Date: Thu, 28 Mar 2019 14:30:19 -0700

Yo All!

Anyone else seeing issues with nts-test.strangled.net:443 ?

3 NTPsec servers, running the same code, only on gets NTPD from
nts-test.  See below.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
	[email-masked]  Tel:+1 541 382 8588

	    Veritas liberabit vos. -- Quid est veritas?
    "If you can’t measure it, you can’t improve it." - Lord Kelvin

Begin forwarded message:

Date: Thu, 28 Mar 2019 14:25:19 -0700
From: Hal Murray via devel <[email-masked]>
To: [email-masked]
Cc: Hal Murray <[email-masked]>
Subject: Fw: [Ntp] NTS Hackathon coordination

Gary said:
> This server is back up:
>     nts-test.strangled.net:443
> I get cookies, but can't connect.  Not sure which end the problem is
> on...   

It works from my home which goes through a NAT box so the source port
isn't NTP.

It doesn't work from ntp1.glypnod.com - same symptoms as you get.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
	[email-masked]  Tel:+1 541 382 8588

	    Veritas liberabit vos. -- Quid est veritas?
    "If you can’t measure it, you can’t improve it." - Lord Kelvin

---

From: Miroslav Lichvar <[email-masked]>
Date: Fri, 29 Mar 2019 10:14:50 +0100

> 3 NTPsec servers, running the same code, only on gets NTPD from

Hm, it looks like a bug in the firewall configuration. It was
disabling connection tracking for packets using port 123 (as is
normally needed on a public server), but that included also responses
from the NTS server, which is running in a container with a private
address, so the responses had a wrong source address.

It should be fixed now.

I still see some clients sending requests with increasing size up to
540 bytes, so I'm not sure if they don't like the shorter responses or
they are getting lost somewhere.

-- 
Miroslav Lichvar

---

From: "Gary E. Miller" <[email-masked]>
Date: Fri, 29 Mar 2019 11:34:57 -0700

Yo Miroslav!

On Fri, 29 Mar 2019 10:14:50 +0100
Miroslav Lichvar <[email-masked]> wrote:

> Hm, it looks like a bug in the firewall configuration.

Maybe the Proposed RFC should mention that firewall rules may
need to be adjusted?

> It should be fixed now.

I can confirm that I can now each nts-test.strangled.net:443 on ipv4
just fine.

But now I'm not getting cookies from: nts3-e.ostfalia.de:443 on IPv4.

RGDS
GARY