PPP filters – stop xntpd from keeping the connection aliveThis article was submitted by Jim Mutter without prompting from me. Many thanks to Jim for writing up his experiences and sending them in. Cheers.
The problemJim uses Userland PPP to connect to his ISP. He also runs xntpd to keep the time on this computer accurate. However, xntpd keeps the connection alive forever if given the opportunity. Normally, ppp will die if there is no traffic. Jim needed a way to make ppp ignore ntp packets when deciding whether or not to keep the connection alive.
The solutionIt is possible to write filtering rules for ppp. So Jim wrote a ruleset to disallow ntp packets when considering the keep alive status.filter. The PPP – Pedantic PPP Primer has a small section (6.2. Playing with PPP filters) on how to do this, however the example listed is incorrect. With a little help from man ppp and more help from the folks on the FreeBSD-Questions mailing list he was able to come up with this solution.
- ‘su’ to root.
- cd /etc/ppp
- vi ppp.conf
- His first attempt at writing the rules.
set filter alive 0 deny udp src eq 123 set filter alive 1 deny tcp src eq 123 set filter alive 2 deny udp dst eq 123 set filter alive 3 deny tcp src eq 123
- This configuration doesn’t allow anything to reset the keepalive filter. The result was that ppp disconnected after the ‘timeout’ value no matter what he was doing.
- The working solution
set filter alive 0 deny udp src eq 123 set filter alive 1 deny tcp src eq 123 set filter alive 2 deny udp dst eq 123 set filter alive 3 deny tcp dst eq 123 set filter alive 4 permit 0 0
That last line is the important one. Here’s a quote from a user on the
Whenever you define a ruleset, there’s in implicit default filter of:set filter alive lastrule+1 deny 0 0
This rule needs to be changed to allow everything not explicitly defined:set filter alive lastrule+1 permit 0 0
This applies to all filters or rulesets defined in /etc/ppp/ppp.conf.
Other PPP filtersAdditional filters include:
dial (for dial on demand) in (for incoming packets) out (for outgoing packets)