# Create rule to allow ntp from specific URL

**URL:** <https://forum.suricata.io/t/create-rule-to-allow-ntp-from-specific-url/4252>\
**Category:** Help\
**Tags:** aws-nfw, aws-network-firewall\
**Created:** [November 27, 2023, 8:55pm UTC](https://forum.suricata.io/t/create-rule-to-allow-ntp-from-specific-url/4252 "2023-11-27T20:55:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![axjoshi](https://avatars.discourse-cdn.com/v4/letter/a/a6a055/32.png) [@axjoshi](https://forum.suricata.io/u/axjoshi)\
**Post date:** [November 27, 2023, 8:55pm UTC](https://forum.suricata.io/t/create-rule-to-allow-ntp-from-specific-url/4252/1 "2023-11-27T20:55:08Z")

</div>

> Please include the following information with your help request:
> 
> - Suricata version AWS network firewall
> - Operating system and/or Linux distribution - AWS network firewall

> - How you installed Suricata (from source, packages, something else). - AWS network firewall

Hello Suricata experts,  
Is there a way to allow only port UDP 123(NTP) from certain domain eg [time.aws.com](http://time.aws.com) ? Currently I am using this rule - pass ntp $HOME\_NET any → $EXTERNAL\_NET 123 (sid:4001; rev:1;) but wanted to tie it down to specific URL

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [December 12, 2023, 8:46pm UTC](https://forum.suricata.io/t/create-rule-to-allow-ntp-from-specific-url/4252/2 "2023-12-12T20:46:35Z")

</div>

The only way I could think of is creating a dedicated variable that you fill with the IPs of the domains, since there is no ntp keyword to match on domain names. This would be something you could do with HTTP, TLS etc.