onderwerp Re: Packet loss only on forwarded port UDP 123 (NTP) in Internet

Packet loss only on forwarded port UDP 123 (NTP)

John_Slow — Wed, 01 Apr 2026 18:54:19 GMT

Hello Ziggo community!

I am a Ziggo customer, I use the black SmartWifi modem and everything works fine, except for a very specific thing.

I am operating an NTP server on my local network, which (as all NTP servers) listens for UDP packets on port 123. This NTP server works flawlessly because it provides time services for a number of clients within my home network for months now and I can provide telemetry that proves its good operation.

I am now trying to make this service available to clients outside of my home network. To achieve that, I created a port forwarding using the modem's admin interface using the following settings:

Local IP address: 192.168.178.205

Local port range: 123

External port range: 123

Protocol: Both (I also tried UDP)

Enabled: check

The problem is that it does not work reliably. Some packets get through and are responded to but other packets are lost. I ran mtr (traceroute) from three different external locations and all of them show a variable packet loss at the last hop (my modem). All those mtr runs use the following command

mtr nts-nl.ordaa.eu -u -P 123 -zrw -i 10 -c 10

...which means:

- trace the route to nts-nl.ordaa.eu (my modem's external IP)

- use UDP packets on port 123

- show "wide" output

- show AS numbers of all hops crossed

- make 10 traces, each 10 seconds apart

- generate a report

Below you can see the last hops of these three traces:

Start: 2026-04-01T14:51:23+0300 HOST: deanna.andromeda.gal Loss% Snt Last Avg Best Wrst StDev [redacted] 3. AS6799 79.128.230.74 0.0% 10 9.3 12.8 9.2 27.7 6.3 4. AS12713 62.75.3.157 40.0% 10 10.1 10.3 9.8 10.9 0.5 5. AS??? 62.75.4.170 0.0% 10 43.9 43.9 43.4 44.6 0.4 62.75.27.206 AS??? 62.75.27.206 62.75.27.18 AS??? 62.75.27.18 62.75.27.30 AS??? 62.75.27.30 62.75.27.202 AS??? 62.75.27.202 6. AS1299 ffm-b18-link.ip.twelve99.net 10.0% 10 43.2 43.1 42.8 43.6 0.2 7. AS1299 ffm-bb2-link.ip.twelve99.net 0.0% 10 43.4 43.3 42.8 43.7 0.3 ffm-bb1-link.ip.twelve99.net AS1299 ffm-bb1-link.ip.twelve99.net 8. AS1299 adm-bb2-link.ip.twelve99.net 10.0% 10 52.8 53.2 52.5 54.3 0.6 adm-bb1-link.ip.twelve99.net AS1299 adm-bb1-link.ip.twelve99.net 9. AS1299 adm-b3-link.ip.twelve99.net 0.0% 10 54.6 53.8 52.3 54.8 0.9 adm-b3-link.ip.twelve99.net AS1299 adm-b3-link.ip.twelve99.net adm-b3-link.ip.twelve99.net AS1299 adm-b3-link.ip.twelve99.net adm-b10-link.ip.twelve99.net AS1299 adm-b10-link.ip.twelve99.net adm-b10-link.ip.twelve99.net AS1299 adm-b10-link.ip.twelve99.net adm-b3-link.ip.twelve99.net AS1299 adm-b3-link.ip.twelve99.net adm-b10-link.ip.twelve99.net AS1299 adm-b10-link.ip.twelve99.net 10. AS1299 libertyglobal-ic-378827.ip.twelve99-cust.net 50.0% 10 54.1 54.0 53.7 54.2 0.2 11. AS??? ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 12. AS33915 213.51.201.189 20.0% 10 55.2 53.5 51.6 55.6 1.8 213.51.201.185 AS33915 213.51.201.185 13. AS??? ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 14. AS33915 80-115-120-72.cable.dynamic.v4.ziggo.nl 40.0% 10 60.5 59.6 56.4 65.1 3.0

Start: 2026-04-01T14:03:29+0200 HOST: [redacted].eu-west-1.compute.internal Loss% Snt Last Avg Best Wrst StDev [redacted] 3. AS50673 46.249.55.194 0.0% 10 14.2 9.6 6.9 15.9 3.2 4. AS50673 185.8.179.34 0.0% 10 8.2 9.5 7.5 14.6 2.0 5. AS??? ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 6. AS??? ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 7. AS??? ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 8. AS33915 213.51.201.189 30.0% 10 16.2 12.1 10.5 16.2 1.9 9. AS??? ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 10. AS33915 80-115-120-72.cable.dynamic.v4.ziggo.nl 80.0% 10 23.7 21.2 18.6 23.7 3.6

Start: 2026-04-01T12:03:12+0000 HOST: [redacted] Loss% Snt Last Avg Best Wrst StDev [redacted] 3. AS8560 212.227.116.199 0.0% 10 0.5 0.5 0.4 0.6 0.1 212.227.116.203 AS8560 212.227.116.203 4. AS8560 ae-9-1460.rc-a.rs.ber.de.net.ionos.com 0.0% 10 0.3 0.6 0.3 0.9 0.2 ae-19-1460.rc-a.rs.ber.de.net.ionos.com AS8560 ae-19-1460.rc-a.rs.ber.de.net.ionos.com ae-8-1460.rc-b.rs.ber.de.net.ionos.com AS8560 ae-8-1460.rc-b.rs.ber.de.net.ionos.com ae-7-1460.rc-b.rs.ber.de.net.ionos.com AS8560 ae-7-1460.rc-b.rs.ber.de.net.ionos.com 5. AS8560 lo-0.bb-b.rs.ber.de.net.ionos.com 0.0% 10 0.9 3.0 0.4 14.1 5.1 ae-9-1460.rc-a.rs.ber.de.net.ionos.com AS8560 ae-9-1460.rc-a.rs.ber.de.net.ionos.com lo-0-0.bb-a.rs.ber.de.net.ionos.com AS8560 lo-0-0.bb-a.rs.ber.de.net.ionos.com 6. AS8560 lo-0-0.bb-b.ltz.ber.de.net.ionos.com 0.0% 10 1.0 6.0 0.4 14.9 5.7 lo-0-0.bb-a.rs.ber.de.net.ionos.com AS8560 lo-0-0.bb-a.rs.ber.de.net.ionos.com 7. AS8560 lo-0.bb-b.fr7.fra.de.net.ionos.com 0.0% 10 10.6 10.7 10.2 11.0 0.2 lo-0-0.bb-b.ltz.ber.de.net.ionos.com AS8560 lo-0-0.bb-b.ltz.ber.de.net.ionos.com 8. AS8560 lo0-0.bb-a.wm.fra.de.net.ionos.com 0.0% 10 9.9 10.2 9.9 11.8 0.6 lo-0.bb-b.fr7.fra.de.net.ionos.com AS8560 lo-0.bb-b.fr7.fra.de.net.ionos.com 9. AS8560 lo0-0.bb-a.wm.fra.de.net.ionos.com 60.0% 10 10.0 9.9 9.9 10.0 0.0 10. AS6830 de-fra02a-rc1-ae-0-0.aorta.net 30.0% 10 29.6 29.8 29.6 30.1 0.2 11. AS6830 nl-ams02a-rc2-lag-11-0.aorta.net 0.0% 10 29.4 29.5 29.4 29.7 0.1 de-fra02a-rc1-ae-0-0.aorta.net AS6830 de-fra02a-rc1-ae-0-0.aorta.net 12. AS??? ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 13. AS33915 213.51.201.185 30.0% 10 30.4 30.4 30.4 30.5 0.1 213.51.201.189 AS33915 213.51.201.189 14. AS33915 213.51.201.185 60.0% 10 30.4 30.4 30.3 30.5 0.1 15. AS33915 80-115-120-72.cable.dynamic.v4.ziggo.nl 20.0% 10 38.0 38.9 36.7 44.1 2.5

On all three traces, the last hop (my modem) shows packet loss between 20% and 80%. This mirrors the experience of actual NTP clients, they keep missing packets all the time and obviously syncing time under these conditions is impossible.

The weird thing is that I also port forward other ports (example the NTS port 4460/TCP) and for those ports the traceroutes come clean with 0% packet loss all the time. So this only affects port 123 or UDP so I suspect some sort of firewalling or rate limiting is involved.

Have you had any experiences like that? Do you know what may be causing it? Is there a way to overcome it so I can share my time service with the world?

Best regards,

Re: Packet loss only on forwarded port UDP 123 (NTP)

tt14111 — Thu, 02 Apr 2026 09:19:10 GMT

The packet loss already occurs before reaching your modem router. I recommend making the NTP server available on IPv6 in addition to IPv4 using the Advanced settings → Security → IP & port filtering page, then test using IPv6 specifically.

Could you disable all options except 'Firewall protection' for both IPv4 and IPv6 on the Advanced settings → Security → Firewall page and disable UPnP on the Advanced settings → UPnP page?

Re: Packet loss only on forwarded port UDP 123 (NTP)

John_Slow — Sat, 04 Apr 2026 15:43:03 GMT

Hello tt14111,

I have disabled all options except for IPv4 and IPv6 firewall protection and I have also disabled UPnP but that has made no difference.

I cannot test IPv6 yet because the remote site where I have access to has some issues with IPv6 but I am still working on that.

Re: Packet loss only on forwarded port UDP 123 (NTP)

Ryan — Tue, 07 Apr 2026 08:18:10 GMT

Hello @John_Slow
We are a few days later. Did you manage to check all te setting option @tt14111 shared in the previous message? We'll like to hear from you again.

Re: Packet loss only on forwarded port UDP 123 (NTP)

John_Slow — Tue, 07 Apr 2026 22:23:58 GMT

Hello Ryan,

As I reported in my previous response, I have only the "firewalll protection" option enabled in the Security/Firewall configuration page of my router and I have also disabled uPnP. The problem still remains. Unfortunately IPv6 is not working at the site where I am running remote tests from to test the second part of tt14111's recommendation, and I cannot seem to be able to fix it. So I am stuck with this.

Of course, having an IPv6 only NTP service is not ideal for me anyway, I would prefer if IPv4 was working too.

The other thing I would like to point out is that it is normal for busy core routers to drop traceroutes like mine. That's why the real packet loss starts after the last hop with 0% dropped packets. Based on that, on the first trace you can see the last 0% hop:

9. AS1299 adm-b3-link.ip.twelve99.net 0.0% 10 54.6 53.8 52.3 54.8 0.9

and its next hop is:

10. AS1299 libertyglobal-ic-378827.ip.twelve99-cust.net 50.0% 10 54.1 54.0 53.7 54.2 0.2

On the third trace, the last good hop (0% dropped packets) is:

11. AS6830   nl-ams02a-rc2-lag-11-0.aorta.net          0.0%    10   29.4  29.5  29.4  29.7   0.1

and the hop after that is:

13. AS33915  213.51.201.185                           30.0%    10   30.4  30.4  30.4  30.5   0.1

AS33915 is Vodafone Libertel B.V. (according to: https://bgp.tools/as/33915) which is your network it seems. Doesn't that mean that the root cause of the packet loss is within your infrastructure and not some 3rd-party carrier?

Re: Packet loss only on forwarded port UDP 123 (NTP)

John_Slow — Tue, 07 Apr 2026 23:36:58 GMT

Here is another trace I made, five days later, this time 30 traces were run, with a 10 second interval. Again, the last hop with no packet loss is number 9, AS1299 (Arelion)

$ mtr -znw -u -P 123 -i 10 -c 30 nts-nl.ordaa.eu Start: 2026-04-08T01:52:03+0300 HOST: deanna.andromeda.gal Loss% Snt Last Avg Best Wrst StDev [redacted] 3. AS6799 79.128.230.74 0.0% 30 6.2 6.4 5.6 8.5 0.6 4. AS12713 62.75.3.157 0.0% 30 6.1 7.1 5.5 9.1 0.8 5. AS??? 62.75.27.30 0.0% 30 50.0 42.6 39.5 62.1 4.7 62.75.27.206 AS??? 62.75.27.206 62.75.27.18 AS??? 62.75.27.18 62.75.4.170 AS??? 62.75.4.170 62.75.4.154 AS??? 62.75.4.154 62.75.27.202 AS??? 62.75.27.202 6. AS1299 213.248.72.9 0.0% 30 39.6 39.4 38.6 39.9 0.3 7. AS1299 62.115.132.232 0.0% 30 39.0 39.9 38.5 56.2 3.1 62.115.132.230 AS1299 62.115.132.230 8. AS1299 62.115.137.222 6.7% 30 49.0 49.4 48.6 50.2 0.4 62.115.120.240 AS1299 62.115.120.240 9. AS1299 62.115.120.227 0.0% 30 49.4 51.1 48.7 70.1 4.2 62.115.138.171 AS1299 62.115.138.171 62.115.136.229 AS1299 62.115.136.229 62.115.138.37 AS1299 62.115.138.37 62.115.142.213 AS1299 62.115.142.213 62.115.142.237 AS1299 62.115.142.237 62.115.136.221 AS1299 62.115.136.221 62.115.138.251 AS1299 62.115.138.251 10. AS1299 62.115.187.127 53.3% 30 50.0 50.3 49.5 51.1 0.5 11. AS??? ??? 100.0 30 0.0 0.0 0.0 0.0 0.0 12. AS33915 213.51.201.185 20.0% 30 47.2 47.4 46.4 52.2 1.1 213.51.201.189 AS33915 213.51.201.189 13. AS??? ??? 100.0 30 0.0 0.0 0.0 0.0 0.0 14. AS33915 80.115.120.72 13.3% 30 53.6 54.1 52.8 58.2 1.4

Re: Packet loss only on forwarded port UDP 123 (NTP)

caesar — Wed, 08 Apr 2026 08:21:25 GMT

@John_Slow

I'm curious about the type of NTP server you're using on your LAN.

That server will give you an accurate time on your LAN, but not a very accurate time on the internet (as you have noticed).

Your internet clients should be using something like nl.pool.ntp.org.

The second problem is that Windows is not using NTP, it is using SNTP, which is far less accurate.

Meinberg is a well known producer of high quality NTP servers, and they have a real NTP client for Windows:

https://www.meinbergglobal.com/english/sw/ntp.htm

Obviously Ziggo should give us an NTP service, include it in the DHCP options, and their routers should do the same, but of course Ziggo doesn't do. They do have time servers, but don't provide NTP services to their customers.

Re: Packet loss only on forwarded port UDP 123 (NTP)

John_Slow — Wed, 08 Apr 2026 18:54:24 GMT

Hello caesar,

I am running a fairly new ntp server called ntpd-rs. It's written in the Rust language. You can see the project here: https://github.com/pendulum-project/ntpd-rs

It is setup to get time directly from a GPS receiver, making it a stratum 1 NTP server. It also supports NTS on port 4460. This makes it much more accurate than any other public NTP servers and it has the perk of working even when my Internet connection is down.

You can check it out yourself with the following command (provided you have the ntpdate program installed):

$ ntpdate -q nts-nl.ordaa.eu 2026-04-08 21:48:47.560938 (+0300) -0.007239 +/- 0.032878 nts-nl.ordaa.eu 80.115.120.72 s1 no-leap

... that is if your packets are not dropped 😕

Re: Packet loss only on forwarded port UDP 123 (NTP)

Jesse — Sun, 12 Apr 2026 15:13:19 GMT

Hi @John_Slow,

I suspect that we do indeed apply rate limiting on UDP/123 (NTP) to prevent abuse. I have submitted this question to our internet engineers in the hope that they can confirm this. Please note that we (Ziggo) do not officially support running or exposing open NTP servers.

Do you have the option to set the Ziggo modem to bridge mode and test this with your own router to find out more? As soon as I have more information about this, I will let you know.

Re: Packet loss only on forwarded port UDP 123 (NTP)

caesar — Mon, 13 Apr 2026 14:54:39 GMT

@John_Slow

Using public NTP servers can give you a very accurate time, this is what I see:

By the way, there is a very cheap standalone NTP server on the market, the Teltonika NTP001.

Re: Packet loss only on forwarded port UDP 123 (NTP)

John_Slow — Mon, 13 Apr 2026 18:05:17 GMT

Do you have the option to set the Ziggo modem to bridge mode and test this with your own router to find out more?

Unfortunately, I do not have a separate router, other than the black smartWifi router that Ziggo provided me.

Re: Packet loss only on forwarded port UDP 123 (NTP)

Jesse — Fri, 24 Apr 2026 12:40:20 GMT

Good afternoon @John_Slow,

So far, it has been confirmed that we do not block this on the modem level. It is possible that it is being blocked on the CMTS level in the ACL (Access Control List). The Engineering team will investigate this further, possibly together with Liberty Global, to determine whether this is a vendor-specific issue or not.

Kindly bear with us for a moment. While we continue to request updates, it might take some time for engineering to get back to me with answers.

Re: Packet loss only on forwarded port UDP 123 (NTP)

Jesse — Tue, 19 May 2026 09:46:49 GMT

Good day @John_Slow,

Hopefully you won't mind my late reply. I have recently received word from Engineering that we do not apply rate filtering on port 123. Therefore, we are unable to say exactly what is causing the instability.