Seems like it works when I use the -u switch. Here's what I tried:
[root@tango3 ~]# ntpdate pool.ntp.org
4 Sep 11:39:56 ntpdate[6920]: no server suitable for synchronization found
[root@tango3 ~]# ntpdate -q pool.ntp.org
server 69.195.159.158, stratum 2, offset 517.109702, delay 0.07394
server 173.230.144.109, stratum 2, offset 517.111545, delay 0.10028
server 66.70.234.51, stratum 3, offset 517.111906, delay 0.09090
server 23.239.24.67, stratum 16, offset 517.107179, delay 0.06207
4 Sep 11:40:23 ntpdate[6998]: step time server 69.195.159.158 offset 517.109702 sec
[root@tango3 ~]# ntpdate -u pool.ntp.org
4 Sep 11:49:44 ntpdate[7109]: step time server 103.105.49.148 offset 517.113160 sec
Documentation says that switch opens an unprivileged port. "This is most useful when behind a firewall that blocks incoming traffic to privileged ports, and you want to synchronise with hosts beyond the firewall."
I don't really know what that means, but seems like firewall is still blocking something, but I can get around it by using an unprivileged port. Is it possible to change the Dash to use an unprivileged port by default?