Re: [Ntp] NAT devices not translating privileged ports

[Fernando Gont <[e-mail]>]

Hi, Miro,

On Mon, 2021-06-07 at 10:30 +0200, Miroslav Lichvar wrote:
> On Fri, Jun 04, 2021 at 07:02:29AM +0000, Fernando Gont wrote:
> > As part of the IESG review of the ntp port randomization draft 
> > (
> > https://www.ietf.org/archive/id/draft-ietf-ntp-port-randomization-06.txt
> > ), we were asked if we could provide a reference for the NAT
> > devices do
> > not translate the source port if the source port is a privileged
> > port
> > (<1024).
> > 
> > Any clues/examples of this type of NATs?
> 
> I don't remember seeing something like that.
> 
> An issue specific to NAT and the anti-DDoS mitigations is that when
> multiple clients are using the same server, only one can have the
> publicly visible port 123 at a time. If that port is blocked in a
> firewall elsewhere in the network, it causes weird behavior, when NTP
> sometimes work and sometime does not.

I'm now considering whether we'd be better off removing the whole
Section 3.4.? i.e., remove this:


---- cut here ----
 3.4.  Effect on NAT devices

  Some NAT devices will not translate the source port of a packet when
  a privileged port number is employed.  In networks where such NAT
  devices are employed, use of the NTP well-known port for the client
  port will essentially limit the number of hosts that may successfully
  employ NTP client implementations.

  In the case of NAT devices that will translate the source port even
  when a privileged port is employed, packets reaching the external
  realm of the NAT will not employ the NTP well-known port as the local
  port, since the local port will normally be translated by the NAT
  device possibly, but not necessarily, with a random port.
---- cut here ----

Thoughts?

Thanks!

Regards,
-- 
Fernando Gont
Director of Information Security
EdgeUno, Inc.
PGP Fingerprint: DFBD 63E3 B248 AE79 C598 AF23 EBAE DA03 0644 1531