because we want to update the local system clock we cannot restrict everything (as it applies also to ourself), but a little bit more restriction is still possible

ntp/ntp.conf

@@ -16,5 +16,6 @@ server     pool.ntp.org iburst
 server     pool.ntp.org iburst
 
 #   restrictions
-restrict   default
+restrict   default   limited noquery nomodify notrap nopeer
+restrict   127.0.0.0 mask 255.0.0.0