On Debian Jessie servers I see systemd-timesyncd listening on random UDP ports. Which is not the case on Debian Stretch hosts. By random I mean the port it listens to varies from server to server. Does it need to listen to a UDP port to work properly? I want to block ports that are not needed. Does this mean I've got to leave all UDP ports open?
The systemd-timesyncd mostly is a ntp/sntp client. IE it will make outbound requests, and get replies. If you are running a statefull firewall then you would need to permit outgoing UDP traffic, and ESTABLISHED/RELATED incoming traffic. You shouldn't need to permit incoming traffic to the port the timesyncd is listening on.