For the benefit of other readers of this topic, can you clarify what kind of query rates per second you classify as being “hit hard”? Is it still around 20 requests/second?
In any case, as you’ve noticed the problem is the number of sessions and NAT. The best way to fix the session problems is to have no sessions at all. The best way to fix NAT problems is to have no NAT at all (except maybe for your “regular” home computers). This can be achieved by the following setup:
MODEM
- Set to bridging mode, ie. it just passes packets back and forth from VDSL to Ethernet.
- No firewall, no NAT, no rate limiting, no DHCP, no internal DNS, no WiFi, no anything
- The modem does not have a public IP address of its own
- The modem’s LAN side has a private IP address for management, like 192.168.99.1 (but you’ll rarely if ever need to access the modem after initial setup, maybe for firmware updates)
HOME SERVER / GATEWAY
- Probably some sort of Linux
- Two network interfaces: One (WAN) that has your public IP address, the other (LAN) has a private IP address like 192.168.100.1
- Runs chrony, ntppool-agent, caching DNS server, possibly DHCP server for LAN, possibly a web server if you want to share NTP server stats
- GPS attached to this server
- Firewall config that does not track incoming NTP requests (“iptables -t raw -A PREROUTING -p udp --dport 123 -j CT --notrack”, “iptables -t raw -A OUTPUT -p udp --sport 123 -j CT --notrack”)
- Firewall config that does NAT for traffic coming to/from your LAN, ip_forward setting enabled
SWITCH / WIFI ROUTER
- Attached to the LAN port of your home server
- If you need WiFi this device can be a WiFi router with some Ethernet ports for some wired connections. If not, a plain regular switch suffices.
ADVANCED TOPICS
- This setup allows giving your LAN devices their own IPv6 addresses from your designated IPv6 network.
(edit: Details about WiFi omitted for now, I need to test this kind of WiFi setup myself first)