One of my nodes had a block installed by the ISP (RackNerd) for allegedly being used in an NTP reflection attack. I’ve had to disable it for now; is this something that happens often? I saw another reference in this forum to a possible NTP DDoS in 2017.
It’s often poor configured clients that request so often that it looks like an attack.
I had one the other day, they kept requesting at 1.2sec, so I wrote them an email and they responded to change it to 15 seconds.
So I emailed them again to tell them that 1 time per 60sec or longer is normal behavior.
Some are real dumb an poll way too often thinking they get better time.
If you have a lot of those, and there are a lot, it may look/behave like a DDoS, it’s just people that have no clue what they are doing. 
Indeed, over a decade ago, NTP was used for amplification attacks. However, the server software closed that vulnerability years ago and it’s not justifiable to block NTP by default anymore, which is probably why your ISP blocked it.
Relatively speaking, yes. I had to drop a few providers (or stop using them for NTP) because of that. I think it is mostly ignorance.
Obviously, not all of them can be experts regarding NTP, so they see a lot of traffic, especially UDP, and from a large (even huge) number of remote sources, and they consider this a potential reflection attack.
Few are open to discussion, and learning about the topic. E.g., pointing out that for a reflection attack to be effective, the number of potential victims should probably be relatively small. I.e., seeing traffic from such a large number of remote sources, and each one mostly every now and then, only (with exceptions), should indicate it is likely not a reflection attack, because of the lack of impact it would have on purported victims.
And old stories about the long-fixed vulnerability in ntpd don’t help either, or pointing to other implementations never ever having had the vulnerable functionality in the first place.
Anyway, I’ve not had issues with RackNerd so far, so surprised to see that they flagged your server. Will have to be more cautious with them then going forward, to minimize the risk of having traffic blocked as well.
You can still use NTP servers for reflection, but not necessarily for amplification. But in some scenarios, reflection attacks are still a viable way for DDoS attacks, when the victim has not much bandwidth and no filtering in place.
Reflection attacks are primarily used to make it harder to trace back the origin, as all packets the victim receives are coming from legitimate servers.
It’s therefore still OK to put a rate limit in place on the server, usually with a pretty high burst rate. My systems are configured to accept a rate of 5 requests per second with a burst of 100 questions. This triggers very seldom and only drops packets in case of reflection attacks or badly misbehaving clients.
There are some persistently abusive NTP clients. Some appear to be Fortigate, others have unknown origins. Sometimes a cluster of machines (e.g., VM) will simultaneously initialize and will exceed the suggested 5/sec, but the burstsize of 100 should handle that situation.
I kick all persistent pollers out that are 15 sec or less for hours.
I managed to write one in Belgium, they changed it, from 1.2sec to 6.5sec.
Ergo, they are blocked now.
With IPv6 address privacy, an address typically expires after a week and stops being used after a day.
Still, a firewall doesn’t have exceptions for private addresses, but only for permanent addresses.
So there’s little difference for an attacker to use previously seen IPv6 addresses from generating them randomly from BGP blocks.