The issue of NTP requests exceeding bandwidth load

[davehart]

@kkursor

I had actual 500 Mbps setting of my netspeed (I have 500Mbps Ethernet connection) and NTP queries were replied by my edge Mikrotik RB4011 without any problems. But now I think I should enable ratelimiting or maybe NAT NTP packages or maybe NAT requests to internal VM which has full-feature NTPD, Chrony and iptables in order to tune loading.

You’re probably much better off leaving the NTP service to the Mikrotik, as NAT/Port Forwarding to an internal server will stress the NAT mapping table and drive up router CPU and memory use. See Monitors belgg1-19sfa9p and belgg2-19sfa9p having hiccups? - #20 by davehart

You could still have the Mikrotik use an internal Chrony or ntpd server as its NTP source so you can make sure it’s serving the best time you can craft with careful selection and more tools than the router’s NTP implemention likely offers.