Port 123 NTP · UDP

What runs on port 123

NTP: clock synchronisation. Every server should be a client of a few upstream sources; very few should be servers. Open NTP servers with monlist enabled were one of the biggest DDoS amplifiers of the 2010s, so modern daemons disable it and restrict queries by default. Wrong time breaks TLS certificate validation, Kerberos, TOTP and log correlation, which is why this port matters more than it looks.

Software that uses it: chrony · ntpd · systemd-timesyncd · Windows Time (w32time) · GPS/PTP appliances

Should port 123 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• chronyc tracking and chronyc sources show offset and which server is being used.
• If you run a public server, "restrict default kod nomodify notrap nopeer noquery" is the baseline.

Check port 123

# on the host: is anything listening, and which process?
ss -lunp 'sport = :123'
sudo lsof -i :123

# from another machine: is it reachable?
nc -zuv host 123
sudo nmap -sU -p 123 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 123

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 123 proto udp
sudo ufw deny 123/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 123 accept
nft add rule inet filter input udp dport 123 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 123 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 123 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=123 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 123" with no source is just "open".

Related ports

• 37 time
• 13 daytime
• 88 Kerberos — Authentication (Active Directory)

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions