# A reminder for nf\_conntrack

**URL:** <https://community.ntppool.org/t/a-reminder-for-nf-conntrack/1189>\
**Category:** Uncategorized\
**Created:** [April 5, 2019, 4:02pm UTC](https://community.ntppool.org/t/a-reminder-for-nf-conntrack/1189 "2019-04-05T16:02:20Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![lordgurke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/lordgurke/32/343_2.png) [@lordgurke](https://community.ntppool.org/u/lordgurke)\
**Post date:** [April 6, 2019, 3:03pm UTC](https://community.ntppool.org/t/a-reminder-for-nf-conntrack/1189/2 "2019-04-06T15:03:00Z")

</div>

Better, just let NTP traffic bypass the connection tracker to eleminate those problems at the root 😉

```
iptables -t raw -I PREROUTING -p udp -m udp --dport 123 -j CT --notrack  
iptables -t raw -I PREROUTING -p udp -m udp --sport 123 -j CT --notrack  
iptables -t raw -I OUTPUT -p udp -m udp --dport 123 -j CT --notrack  
iptables -t raw -I OUTPUT -p udp -m udp --sport 123 -j CT --notrack  

```

This will simply let the connection tracker just ignore all traffic from or to port 123/UDP.  
But, of course, you then cannot use “-m state” for those ports and you need to make sure that both outgoing and incoming traffic (answers) can flow through your firewall.

---

_[View the full topic](https://community.ntppool.org/t/a-reminder-for-nf-conntrack/1189)._