Wednesday, March 18, 2015

ntpq and IPv6

I was getting an error from ntpq:
# ntpq -p
ntpq: write to localhost failed: Operation not permitted
This was a little weird until I strace'd it and found it was querying the IPv6 localhost address and I had shut down IPv6 with ip6tables via:
# Generated by ip6tables-save v1.4.14 on Thu Jan  1 14:46:44 1981
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
COMMIT
# Completed on Thu Jan  1 14:46:44 1981
in /etc/iptables/rules.v6. A change to
# Generated by ip6tables-save v1.4.14 on Thu Jan  1 14:46:44 1981
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -s ::1/128 -d ::1/128 -j ACCEPT
-A OUTPUT -o lo -s ::1/128 -d ::1/128 -j ACCEPT
COMMIT
# Completed on Thu Jan  1 14:46:44 1981
made things better. Moral: pay attention to shutting off v6 unless you really need it, but allow loopback. I could have changed priorities in /etc/gai.conf or shut off v6 completely, but choose not to.

No comments: