Port 123: NTP port for time synchronization

Computers use port 123 to synchronize their system clocks with a time server. Accurate time matters more than it may seem: TLS certificates, Kerberos, log files, cron jobs, and distributed databases all depend on systems sharing the same time. Clients such as chrony, ntpd, and systemd-timesyncd query one or more time servers and gradually correct the local clock. The time server responds to these requests on port 123.

NTP was developed by David L. Mills at the University of Delaware and is one of the oldest Internet protocols still in active use. The current version, NTPv4, is described in RFC 5905. IANA has officially assigned port 123 to the “ntp” service, placing it in the well-known port range of 0 to 1023. SNTP is a simplified variant without the complex filtering algorithms and also uses port 123.

• Synchronizing Linux and Windows servers with public time servers
• Internal time server used to synchronize all systems on the network
• Essential for valid TLS certificates, Kerberos tickets and consistent log files
• Synchronized time for clusters, database replication, and monitoring

You only need inbound port 123 if your server itself acts as a public NTP server. A standard server that only synchronizes its clock is a client and needs no inbound rule: the firewall allows responses to its requests as part of the established connection. Open, misconfigured NTP servers have been widely abused for amplification attacks: using the old monlist command (CVE-2013-5211), a small spoofed request generated a very large response to the victim. If you run an NTP server, keep its software up to date, disable queries such as monlist and, ideally, allow requests only from your own networks.