Good news - for me at least. I got back to this issue and tried doing this exact thing, except that I left the action as “masquerade” instead of “src-nat”. And it worked! It now does the port translation properly, NTP works, and I didn’t need to specify my external IP address (which is static, but still assigned via DHCP, so I didn’t want to hardcode that in the rule).
Ah, masquerade can do port translation… I did not know that, I thought it was available only with src-nat and dst-nat.
Checking in the GUI I see the option indeed is offered to do that.
Hmm
I just set up the ntp package on my router (downloaded and installed), so that my router was used as a common NTP source.
The router gets its NTP information from the net via the ntp client settings (no fw rules required)
The only thing I had to do was allow whatever devices behind the router needed access to the service on my router
add action=accept chain=input comment=“Allow NTP server” connection-state=new
dst-port=123 in-interface-list=LAN protocol=udp src-address-list=“firewalladdresslist”
How is your case different and in that regard..
Vilx can you summarize what you have done.
Requirement what the use case was different from straight NTP server.
I wouldn’t say my case/requirements are different, just that I tried this solution first because it seemed simpler/easier/lightweight compared to setting up a whole ntp server. I do see the benefits of that too however and maybe one day I’ll decide to do that, who knows. Right now though I’m happy.
What I did I described above - copied the one and only default NAT rule and added source port/protocol and destination port range. Then moved it before the default rule and added a descriptive comment above.