Re: [Ntp] NAT devices not translating privileged ports

[Miroslav Lichvar <[e-mail]>]

On Fri, Jun 11, 2021 at 01:56:59AM +0000, Fernando Gont wrote:
> > There is an effect of NAT that could be mentioned if you are
> > considering some replacement for the text. NATs typically have a
> > shorter timeout for UDP sessions that the client polling interval, so
> > if there are multiple clients using the same server behind NAT, their
> > source port from the server's point of view will be randomized even
> > if
> > their local port is the same.
> 
> 
> Are you assuming that if there's a "collision" at the NAT, the NAT will
> change the service port to some other port?

Yes. If there are multiple connections to a server, they cannot share
the same port of the NAT. If the source port 123 is blocked as a
mitigation against the mode-6 amplification attacks, this can cause
weird issues with NTP clients sometimes working and not working due to
the randomness of the connection that gets the port 123.

-- 
Miroslav Lichvar