Kai Giebeler's questions

I installed ntpd on my Debian host machine to keep the hardware RTC "up-to-date". By sharing the system's clock the time gets automatically propagated to all installed containers (lxc). One of those containers runs my router.

I'd like to use this router to propagate its time to all interested devices in my networks, so they don't need an internet connection by themselves. I don't want to use the host as server (hopefully disabled by interface ignore all).

How can I install and configure a pure ntp-server in a container, which takes the system's clock as its only reference? It shall never set the clock by itself.

How can I install and configure a pure ntp-client, which doesn't accept incoming connections from other peers and leaks as few informations as possible?

I'm rebuilding my router using nftables on debian jessie. I have a working setup up to the moment where my ISP decides to reassign a new WAN IP by reconnecting my DSL-link. After such a reconnect the router itself has an online connection, but masquerading doesn't work any more.

nftable setup before reconnect:

# nft list table nat
table ip nat {
    chain prerouting {
            type nat hook prerouting priority 0; policy accept;
    }

    chain postrouting {
            type nat hook postrouting priority 100; policy accept;
            oif ppp0 masquerade
    }
}

nftable setup after reconnect:

# nft list table nat
table ip nat {
    chain prerouting {
            type nat hook prerouting priority 0; policy accept;
    }

    chain postrouting {
            type nat hook postrouting priority 100; policy accept;
            oif 8 masquerade
    }
}

So I assume the downtime of ppp0 during the reconnect causes the related rules to be some kind of unassigned. Manually re-applying the nft rules (flush + add) solves this problem until the next reconnect.

How can I ensure the temporarily disabled rules will be automatically reassigned to ppp0 after the connection has been re-established?