I noticed a massive amount of UDP traffic on port 123 that I have no idea where is coming from.
In my definition of massive, this would mean you see traffic on port 123 consistently every second, e.g. over a whole minute.
And you say you have not requested this. For example you have not listed yourself as a public NTP server :). Or configured 5+ other computers to use this NTP server, and been watching the traffic when all 5 are turned on at the same time.
If so, there is another possibility that could explain this. Someone could be trying to use your computer as part of a flooding attack on someone else. Look up "NTP amplification attack". Top Google results include explanations from companies like Cloudflare, who sell services protecting websites from flooding attacks.
(I've seen this happen myself but with uPNP traffic, UDP port 1900, on a consumer router with a bad configuration.)
At this point, my assumption is that attackers are still trying to use you and will continue for some time. If you block them half-way through an attack, they won't necessarily get any signal that this has happened. They might notice later on, when they re-scan for amplifying NTP servers they can use.
It sounds as if your router config change just didn't work for some reason...
I guess the port forward I made on my router took a while to kick in. Basically what I did was forward all UDP traffic on port 123 to 192.168.2.3. On my LAN, all IPs are 192.168.1.*. I don't know why the traffic was being delivered to my Linux box in the first place. The router is supposed to block everything except the port forwards I manually define.
Oh. If you add this condition, I don't understand the situation, sorry. I can't understand why you would ever see these conditions, unless I start nitpicking what you've said.
Note that sometimes people configure a separate setting labelled as "DMZ" or maybe "default port forward" to a server like your Odroid, which basically forwards all ports which you don't have a specific rule for. I initially assumed you had some setup like that. If I were you, I would look for such a configuration option. It is quite plausible that I would have set this option earlier and forgotten about it.
I'm not 100% sure so far. I might also double-check that I was only seeing incoming UDP, and that I wasn't not seeing equal or greater amounts of outgoing UDP. If there is also a "massive amount" of unexpected outgoing UDP on port 123, it would suggest the Odroid had been taken over. Then you should re-install it from scratch with careful attention to security (up-to-date software, and careful about SSH access).
I think those are the most likely interpretations. The second case is less familiar to me. I haven't seen popular articles about generic server Linux distributions being compromised for flooding attacks (i.e. compromise through SSH or a web server) - and particularly not by ARM-compatible malware. All of that is possible, but I don't know how common it is.