Firefox Addons Unable to Update, Undisclosed AMO Issues

Re:Firefox Addons Unable to Update, Undisclosed AMO Issues by addingnumbers on Saturday September 25, 2021 @12:22PM (#28654315)

Some ISPs (e.g. AT&T) block outbound traffic from subscribers with source port 123, to mitigate NTP reflection attacks.

Shouldn't necessarily break your NTP client, right? The client's destination port needs to be 123 but the source port can be anything.

But many NTP clients use port 123 as both the destination and source port.

For a while I had a netfilter POSTROUTING rule that would match outbound packets with source port 123 and force translation of the source port to the 60000-65000 range, which had all my NTP clients working again.

[ Parent | on HN ]

Re:Firefox Addons Unable to Update, Undisclosed AMO Issues by hda2 on Saturday September 25, 2021 @10:45PM (#28658009)

Can you please share the iptables rule?

[ Parent | on HN ]

Re:Firefox Addons Unable to Update, Undisclosed AMO Issues by addingnumbers on Sunday September 26, 2021 @12:04PM (#28662004)

iptables -t nat -I POSTROUTING -p udp -m udp --sport 123 -j MASQUERADE --to-ports 60000-61000

I don't know why I didn't specify the outbound interface but I probably should have (-o $wan_interface), anyway it did the job for a long time.

The breakthrough I needed to get it to work was discovering that --to-ports option, which I'd never used or seen in the wild before facing this problem.

[ Parent | on HN ]