Port 123 (NTP)

Network Time Protocol for clock synchronization. Clients send from a random or the same port to UDP 123 on the server.

Well-known (system) port, 0-1023 UDP Network infrastructure Expose only to trusted sources

Port 123 is normally used over UDP; the checker tests TCP only, so a "filtered" result does not mean the UDP service is down.

What port 123 is used for

Network Time Protocol for clock synchronization. Clients send from a random or the same port to UDP 123 on the server.

Security: should port 123 be open?

Expose only to trusted sources. Only public NTP servers should answer the internet. Older ntpd answered 'monlist' queries with large replies and was abused for major amplification attacks; disable monlist (noquery) or use chrony. Outbound UDP 123 must be allowed for time sync.

IANA assignment

Service nameProtoDescriptionAssigneeReference

ntp TCP Network Time Protocol Dave Mills RFC 5905

ntp UDP Network Time Protocol Dave Mills RFC 5905

Check what is listening on port 123

Linux: UDP 123

sudo ss -ulnp 'sport = :123'

Linux / macOS: which process owns the port

sudo lsof -nP -i :123

Windows (Command Prompt)

netstat -ano | findstr :123

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 123

Test it from outside

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 123

Allow only trusted sources on port 123 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 123 proto udp

iptables

sudo iptables -A INPUT -p udp --dport 123 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 123 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 udp dport 123 accept
sudo nft add rule inet filter input udp dport 123 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'UDP 123 trusted' -Direction Inbound -Protocol UDP -LocalPort 123 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.