Keeping a NTP server secure


Over the years, bad actors have used the Network Time Protocol (NTP) as a successful DDOS attack vector.

Generally speaking, the cause of these attacks is due to NTP mis-configuration.

This post will look at how to build and configure an NTP server and provide insight to help keep your NTP server safe.


1. You are not exposing this server to the public internet

2. You are running several NTP servers within your network to keep it highly-available. Tip: Using Anycast is a good way to create a highly-available set of NTP servers for a larger-sized network

3. If you really need very accurate time, do not run NTP servers on Virtual Machines or Containers.

4. You are running a firewall that blocks packets that come from outside the network on UDP port 123


Debian based systems:

apt-get install ntp

Linux based systems:

yum install ntp


This is an example configuration for a Linux Server with upstream time servers and NTP clients connecting to the server from the network.

iptables rules:

-A INPUT -s 0/0 -s 0/0 -p udp --source-port 123:123 -m state --state ESTABLISHED -j ACCEPT

-A OUTPUT -s 0/0 -s 0/0 -p udp --destination-port 123:123 -m state --state NEW,ESTABLISHED -j ACCEPT


I strongly suggest you use some type of configuration management system to manage NTP configuration over a fleet of systems.

I recommend:


Last modified: 25 April 2020