Udp packets not filtered

[Aloist]

I have had a recent problem when one of our servers was incorrectly configured for ntp, and then was abused for
NTP Amplification DDoS Attack.
Because it gets ntp broadcasts from the Lan, it does not need to receive ntp packets from the Internet.

I have created a firewall rule, which on the WAN side blocks all incoming ntp packets to this server's IP, udp port 123.

But when I use tcpdump on the server to see incoming udp packets port 123, I still see massive amounts of them.
It seem that the firewall rule does not work.

What could be going on here?

[Aloist]

I found the reason myself.
I had another, more general rule allowing incoming ntp packets. That rule took priority over the blocking rule.

[siga75]

configuring NTP for accepting broadcast is a BAD security implementation, also restrict the conf to only act like a client, by default it will reply to any NTP request, something like

driftfile /var/lib/ntp/drift

restrict default ignore
restrict -6 default ignore

restrict 127.0.0.1
restrict -6 ::1

server xx.xx.15.100 maxpoll 6 iburst
server xx.xx.15.101 maxpoll 6 iburst
server xx.xx.15.102 maxpoll 6 iburst
server xx.xx.15.103 maxpoll 6 iburst

restrict xx.xx.15.100 nomodify notrap nopeer noquery
restrict xx.xx.15.101 nomodify notrap nopeer noquery
restrict xx.xx.15.102 nomodify notrap nopeer noquery
restrict xx.xx.15.103 nomodify notrap nopeer noquery