just spin up a separate network namespace and macvlan device to run your ntpd in. it&#x27;ll get a separate v6 address via router advertisement and ntpd will be the <i>only</i> thing listening on that address.<p>just wrap ntpd in firejail[1].<p>ipv6-per-networked-process pretty much brings an end to portscanning.<p>[1] <a href="https:&#x2F;&#x2F;firejail.wordpress.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;firejail.wordpress.com&#x2F;</a>