Iptables NTP WRT54G Sveasoft

All,

I posted this awhile back as a question on how to redirect NTP traffic from our remote AP's to our local nocat server so it could
respond from it's own NTP server.

Needless to say... This never functioned correctly, but here is a solution to allow ALL ntp traffic to the outside world.

1) Modify nocat.conf and add the following (for WRT54G w/ Sveasoft.   If other hosts are needed, then change).
##
# AllowedTimeHosts - Optional.  List any time domains that you would like
# to allow access to (UDP ports 2049 and 123).
AllowedTimeHosts time.nist.gov swisstime.ee.ethz.ch clock.tl.fukuoka-u.ac.jp 192.36.133.130 192.168.2.2

*NOTE:  I know that nfs 2049 is in there... But the wrt54g uses 2049 as it's source port with a destination of ntp. :(

2) Modify lib/NoCat/Firewall.pm to read:
my @Perform_Export = qw(
    InternalDevice ExternalDevice LocalNetwork AuthServiceAddr DNSAddr
    GatewayAddr GatewayPort IncludePorts ExcludePorts AllowedWebHosts AllowedTimeHosts
    MembersOnly RouteOnly IgnoreMAC
);

3) Modify initialize.fw to read:
        # Allow NTP Traffic.
        if [ "$AuthServiceAddr" -o "$AllowedTimeHosts" ]; then
            for host in $AuthServiceAddr $AllowedTimeHosts; do
                for port in 123 2049; do
                    $nat      -s $net -d $host -p udp --dport $port -j MASQUERADE
                    $redirect -s $net -d $host -p udp --dport $port -j RETURN
                    $fwd -s $net -d $host -p udp --dport $port -j ACCEPT
                    $fwd -d $net -s $host -p udp --sport $port -j ACCEPT
                done
            done
        fi

4) Shut down gateway.   /etc/init.d/iptables restart  and fire gateway back up.

I know that this is not the most secure solution... But this solution will allow ALL ntp products on the wireless side to
communication with the oustide world so long as they utilize one or more of the time host names specified in AllowedTimeHosts.

Good luck and I truly hope this helps someone who experienced similar issues to mine.

--Todd