<html><head></head><body><div class="gmail_quote">On January 25, 2019 3:36:36 a.m. CST, Trevor Cordes <trevor@tecnopolis.ca> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">I noticed that at one of the customers I have that uses low-end business<br>MTS has had their NTP incoming/outgoing port (UDP 123) cut off (filtered)<br>at the ISP. Incoming I can understand, but outgoing? All the computers in<br>the office have their time out of sync now.<br><br>Does anyone know what the internal Bell/MTS time server's IP/domain is?<br>Surely they didn't cut us off to their internal one.<br><br>Will have the customer contact them eventually, but you know how it goes<br>with tech support. Looking for the quick solution...<br><br>Anyone else have their UDP 123 cut off since Bell came along?<br><br>Further: it looks like they are filtering outgoing only if your source<br>port is also 123. That is hardcoded into ntp (from what I've read). But<br>ntpdate allows the -u option to have the src port be >1024. I tried that<br>and ntpdate -u does work, but ntpdate without the -u gets blocked. So<br>they really are blocking in and out, but only src=123udp.<br><br>Looks like chrony (and others) lets you specify src port, but I'm loathe<br>to uproot the system I know because Bell is braindead. (MTS didn't use to<br>block it, and block-happy Shaw does not block it.)<hr>Roundtable mailing list<br>Roundtable@muug.ca<br><a href="https://muug.ca/mailman/listinfo/roundtable">https://muug.ca/mailman/listinfo/roundtable</a><br></pre></blockquote></div><br clear="all">MTS has been blocking NTP for at least 3 years, I think more but can't be certain.<br>They did it when NTP was being exploited as a DDoS vector worldwide. Apparently enough customers had routers/PCs hooked up that were exploitable that it was becoming a serious nuisance.<br>IIRC a handful of "important" NTP servers are whitelisted, e.g. time.windows.com and the equivalent from Apple.<br>The source port limitation is specifically because only full-fledged NTP server implementations were vulnerable, and they must by definition use port 123.<br>The block only exists for ADSL/VDSL/FTTH customers AFAIK. Business fibre and SHDSL customers are expected to run firewalls that work.<br>-Adam<br>-- <br>Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>