Does RouterOS block NTP traffic by default?

Good news - for me at least. I got back to this issue and tried doing this exact thing, except that I left the action as “masquerade” instead of “src-nat”. And it worked! It now does the port translation properly, NTP works, and I didn’t need to specify my external IP address (which is static, but still assigned via DHCP, so I didn’t want to hardcode that in the rule).

Thank you all! :slight_smile:

Ah, masquerade can do port translation… I did not know that, I thought it was available only with src-nat and dst-nat.
Checking in the GUI I see the option indeed is offered to do that.

Hmm
I just set up the ntp package on my router (downloaded and installed), so that my router was used as a common NTP source.
The router gets its NTP information from the net via the ntp client settings (no fw rules required)

The only thing I had to do was allow whatever devices behind the router needed access to the service on my router
add action=accept chain=input comment=“Allow NTP server” connection-state=new
dst-port=123 in-interface-list=LAN protocol=udp src-address-list=“firewalladdresslist”

How is your case different and in that regard..
Vilx can you summarize what you have done.

  1. Requirement what the use case was different from straight NTP server.
  2. Interacting FW rules and order

I wouldn’t say my case/requirements are different, just that I tried this solution first because it seemed simpler/easier/lightweight compared to setting up a whole ntp server. I do see the benefits of that too however and maybe one day I’ll decide to do that, who knows. Right now though I’m happy.

What I did I described above - copied the one and only default NAT rule and added source port/protocol and destination port range. Then moved it before the default rule and added a descriptive comment above.