Port reference
Port 123 (UDP) – NTP
Network Time Protocol — synchronizes system clocks across networks.
Quick facts
- Transport
- udp
- Category
- Well-known
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on NTP servers and many devices that also act as time sources. Often left as an open, queryable server on the internet.
What is port 123 used for?
Port 123 carries NTP (Network Time Protocol), which keeps a computer's clock
accurate by syncing with time servers over the internet or your network. It's what
powers ntpd, chrony, the Windows Time service, and pool sources like
pool.ntp.org. Accurate time matters everywhere — TLS certificates, logins,
scheduled tasks, and log timestamps all depend on it — so nearly every server and
network device speaks NTP.
When would you open it?
Most devices only act as NTP clients and need no inbound port open. You'd open port 123 for incoming traffic only if you run a time server that other machines sync to, for example a local NTP server for your network or a public pool member.
Is it safe to open?
An open NTP server can be abused for amplification DDoS attacks, so restrict who can query it, keep the software current, and rate-limit it at the network edge. See the security notes below.
How to check if this port is open
ss -tulpn | grep :123
nmap -sU -p 123 <target>netstat -ano | findstr :123
Test-NetConnection <host> -Port 123 # TCP onlylsof -i :123
nmap -sU -p 123 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 123 to your device's local IP, internal port 123, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 123/udpsudo firewall-cmd --permanent --add-port=123/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 123 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 123" -Direction Inbound -Protocol UDP -LocalPort 123 -Action AllowSecurity & risks
Common attacks
- NTP amplification DDoS via the monlist command (CVE-2013-5211)
- Time-shifting attacks to break TLS, Kerberos, and log integrity
- Spoofed responses to skew or stall clients' clocks
- Mode 6/7 query abuse for reconnaissance and reflection
Hardening
- Disable monlist / restrict mode 6 and 7 queries (noquery)
- Upgrade to ntpd 4.2.7p26+ or use chrony to remove monlist
- Use 'restrict' directives to limit who can query and modify
- Authenticate peers with symmetric keys or NTS where possible
- Rate-limit and block spoofed-source traffic at the network edge
How to block this port
sudo ufw deny 123/udpsudo firewall-cmd --permanent --remove-port=123/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 123 -j DROPNew-NetFirewallRule -DisplayName "Block 123" -Direction Inbound -Protocol UDP -LocalPort 123 -Action Blocknmap snippet
nmap -sU -p123 --script ntp-info,ntp-monlist <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is NTP used for DDoS amplification?
- The legacy monlist command returns a large list of recent clients from a tiny request, so attackers spoof a victim's IP and reflect huge responses off open NTP servers.
- How do I stop NTP amplification?
- Disable the monlist/mode 7 query (or upgrade to ntpd 4.2.7p26+ or chrony), apply restrict noquery directives, and filter spoofed source addresses at your edge.