Seems like it works when I use the -u switch. Here's what I tried:
[root@tango3 ~]# ntpdate pool.ntp.org
4 Sep 11:39:56 ntpdate: no server suitable for synchronization found
[root@tango3 ~]# ntpdate -q pool.ntp.org
server 22.214.171.124, stratum 2, offset 517.109702, delay 0.07394
server 126.96.36.199, stratum 2, offset 517.111545, delay 0.10028
server 188.8.131.52, stratum 3, offset 517.111906, delay 0.09090
server 184.108.40.206, stratum 16, offset 517.107179, delay 0.06207
4 Sep 11:40:23 ntpdate: step time server 220.127.116.11 offset 517.109702 sec
[root@tango3 ~]# ntpdate -u pool.ntp.org
4 Sep 11:49:44 ntpdate: step time server 18.104.22.168 offset 517.113160 sec
Documentation says that switch opens an unprivileged port. "This is most useful when behind a firewall that blocks incoming traffic to privileged ports, and you want to synchronise with hosts beyond the firewall."
I don't really know what that means, but seems like firewall is still blocking something, but I can get around it by using an unprivileged port. Is it possible to change the Dash to use an unprivileged port by default?