[accountofme]

why not just point pool.ntp.org to your router ip on the dns server?

then you need not open them up to anything :)

[1MachineElf]

Yeah, I really should do that. The current DNS setup is just using AdGuard Home. From what I can see, it doesn't support custom rules. Down the road I will setup something that provides this, most likely BIND forwarding to AdGuard.

[accountofme]

Yeah that is cool, I use dnscrypt proxy myself, it is a go application which can apply rules and filters ;) good luck with the upgrade :D