NTP Blocked by the Firewall: Diagnosing UDP Port 123
Updated July 2026 · Opening UDP 123 is the easy part — here is what to check when NTP still refuses to sync
Understanding NTP & Firewalls
Why NTP Gets Blocked
| Issue | Cause | Impact |
|---|---|---|
| Outbound blocked | Firewall blocks UDP 123 to external servers | Cannot sync with any NTP server |
| Inbound blocked | Stateful firewall drops response packets | Timeout errors, "unreachable" status |
| NAT issues | Source port changes during NAT translation | Symmetric NAT breaks NTP |
| ISP blocking | Some ISPs block UDP 123 entirely | Must use alternative methods |
NTP Ports: Is There More Than One?
Classic NTP uses a single port: UDP 123, as its default and only transport port, for both the source and the destination. There is no TCP fallback and no secondary port — so a host that cannot reach UDP 123 cannot synchronize at all.
The exception is NTS (Network Time Security), the authenticated variant. NTS performs a key exchange over TCP 4460 first, then carries the actual time packets over UDP 123 as usual. If you are deploying NTS and only opened 123, the key exchange fails before a single time packet is sent — a failure mode that looks exactly like a blocked firewall. See how NTS works in production if that is your case.
Inbound or Outbound: Which Direction Do You Open?
It depends on what the machine is, and getting this wrong is the most common cause of a rule that looks correct but changes nothing:
- NTP client (a server or workstation that only reads the time): outbound UDP 123 only. The replies come back on an established flow, so a stateful firewall lets them in without an explicit inbound rule.
- NTP server (a machine other hosts query): inbound UDP 123 as well, otherwise queries never reach the daemon.
If you opened inbound on a pure client, you have widened your exposure without fixing anything — and if your firewall is stateless, the missing piece is the return path, not the outbound rule. The sections below give the exact commands per platform.
Linux: iptables Configuration
Allow Outbound NTP (Client Mode)
Allow Inbound NTP (Server Mode)
Save Rules Permanently
Linux: firewalld (RHEL/CentOS/Fedora)
Enable NTP Service
Or Open Port Directly
Zone-Specific Configuration
Linux: ufw (Ubuntu/Debian)
Simple Configuration
Allow Only Outbound (More Secure)
Restrict to Specific Servers
Windows Firewall
PowerShell Commands
GUI Method
- Open
Windows Defender Firewall with Advanced Security - Click Inbound Rules → New Rule
- Select Port → UDP → Specific local ports: 123
- Select Allow the connection
- Apply to Domain, Private, Public as needed
- Name: "NTP UDP 123"
- Repeat for Outbound Rules
Check Windows Time Service
Enterprise Firewalls
Cisco ASA
Palo Alto
pfSense / OPNsense
- Go to Firewall → Rules → LAN
- Add rule: Protocol UDP, Destination Port 123
- Action: Pass
- Description: "Allow NTP"
Testing NTP Connectivity
Test UDP Port 123
Test NTP Protocol
Diagnose Blocked NTP
Frequently Asked Questions
Does NTP use TCP or UDP?
UDP. Classic NTP runs over UDP port 123 only and has no TCP mode. The one exception is NTS, which opens a TCP 4460 key exchange before falling back to UDP 123 for the time packets themselves — see NTP Ports: Is There More Than One? above for what that means for your rules.
The port 123 is open but NTP still won't synchronize. Why?
Because an open port is only the first of four conditions. The packet still has to survive NAT translation, return on the source port the client expects, and be accepted by the daemon's own restrict rules. Work through them in order: start with the counter check on your firewall rule — if it shows zero packets, nothing is even reaching it — then move to the packet-level diagnosis.
Should I open port 123 inbound or outbound?
Outbound only if the machine is an NTP client, inbound as well only if it serves time to other hosts. Opening inbound on a client widens your exposure without fixing anything. The inbound vs outbound section above sets out both cases and the stateless-firewall exception.
What is the default NTP port?
UDP 123, for both source and destination — NTP is one of the few protocols that uses the same port on both ends, which is precisely why NAT and stateless firewalls break it in ways a simple port test won't reveal. The NTP ports section explains the consequence.
Test Your Configuration
After configuring your firewall, verify everything works:
See also: CLI testing commands · Why opening UDP/123 is required for NIS 2 compliance
Production use case: full NTP sync audit — 4.2s drift fixed (FR)