I believe ntpdate requires 2-way communication with the ntp server you're attemtping to contact, so you'll need to allow 123/udp from the time server:

-A RH-Firewall-1-INPUT -m udp -p udp -s [server ip]/32 --sport 123 -d 0/0 --dport 123 -j ACCEPT

The "RH-Firewall-1-INPUT" portion will depend on your linux distribution and issue. Modify it to match the preexisting rules in your /etc/sysconfig/iptables file.