Re: [Ntp] NAT devices not translating privileged ports

[Miroslav Lichvar <[e-mail]>]

On Fri, Jun 04, 2021 at 07:02:29AM +0000, Fernando Gont wrote:
> As part of the IESG review of the ntp port randomization draft 
> (
> https://www.ietf.org/archive/id/draft-ietf-ntp-port-randomization-06.txt
> ), we were asked if we could provide a reference for the NAT devices do
> not translate the source port if the source port is a privileged port
> (<1024).
> 
> Any clues/examples of this type of NATs?

I don't remember seeing something like that.

An issue specific to NAT and the anti-DDoS mitigations is that when
multiple clients are using the same server, only one can have the
publicly visible port 123 at a time. If that port is blocked in a
firewall elsewhere in the network, it causes weird behavior, when NTP
sometimes work and sometime does not.

-- 
Miroslav Lichvar