PPP filters – stop xntpd from keeping the connection alive

PPP filters – stop xntpd from keeping the connection alive

This article was submitted by Jim Mutter without prompting from me.  Many thanks to Jim for writing up his experiences and sending them in.  Cheers.

The problem

Jim uses Userland PPP to connect to his ISP.  He also runs xntpd to keep the time on this computer accurate.  However, xntpd keeps the connection alive forever if given the opportunity.  Normally, ppp will die if there is no traffic.  Jim needed a way to make ppp  ignore ntp packets when deciding whether or not to keep the connection alive.

The solution

It is possible to write filtering rules for ppp. So Jim  wrote a ruleset to disallow ntp packets when considering the keep alive status.filter.  The PPP – Pedantic PPP Primer has a small section (6.2. Playing with PPP filters) on how to do this, however the example listed is incorrect.  With a little help from  man ppp and more help from the folks on the FreeBSD-Questions mailing list he was able to come up with this solution.

1. ‘su’ to root.
2. cd /etc/ppp
3. vi ppp.conf
4. His first attempt at writing the rules.
   

   set filter alive 0 deny udp src eq 123
   set filter alive 1 deny tcp src eq 123
   set filter alive 2 deny udp dst eq 123
   set filter alive 3 deny tcp src eq 123

5. This configuration doesn’t allow anything to reset the keepalive filter.  The result was that ppp disconnected after the ‘timeout’ value no matter what he was doing.
6. The working solution
   

   set filter alive 0 deny udp src eq 123
   set filter alive 1 deny tcp src eq 123
   set filter alive 2 deny udp dst eq 123
   set filter alive 3 deny tcp dst eq 123
   set filter alive 4 permit 0 0

That last line is the important one.  Here’s a quote from a user on the FreeBSD-Questions
mailing list:

Whenever you define a ruleset, there’s in implicit default filter of:

set filter alive lastrule+1 deny 0 0 

This rule needs to be changed to allow everything not explicitly defined:

set filter alive lastrule+1 permit 0 0

This applies to all filters or rulesets defined in /etc/ppp/ppp.conf.

Other PPP filters

Additional filters include:

dial (for dial on demand)
in (for incoming packets)
out (for outgoing packets)

Other filters

Finally, this is a beginning for defining packet filtering rules, however it’s really not very powerful.  If you need something more complex you should look into the ipfilter package which works with the kernel level pppd.