As with all the common ports (<1024), there's always a chance the ISP is blocking it. You can save yourself a lot of wasted effort by testing it while connected directly to the modem (if that's an option).
It can't be my ISP, as the same port forwarding arrangement works fine on a different router.
Netgear Tech Support people have gone through all my settings and concluded the router is faulty. However, searching various forms has revealed that a number of other people have the same issue - so I'm inclined to believe that a bug in the firmware is responsible. Netgear Tech Support reports it has no record of any instances of this problem and will not admit to there being an issue with the firmware!
I guess a bug is always possible, but it seems so unlikely. Knowing how these things are coded, it just accepts the specified external port and maps it to an internal port using a simple firewall rule (in Linux terms, using iptables). It wouldn’t even particularly notice/care about the specific port UNLESS the router was perhaps offering up that service itself (so you’d have a conflict). But other than that, I have no idea. Port 123 is only a time service.
The only suggestion I can make is to perhaps install dd-wrt (third party firmware). I checked the dd-wrt database and v1 and v2 are supported.
I've come to the conclusion that the router is refusing to forward port 123 because (a) it is using 123 itself or (b) there is a bug in the router firmware. I downloaded the dd-wrt firmware a couple of days ago and am preparing to try it. I'll let you know how I get on.
Thank you for your interest and attempts to help me. You might be interested to know that the reason I need to forward port 123 is to enable a Vodafone SureSignal2 (a Femtocell) to function. It requires time synchronisation via 123 and works perfectly with my old Belkin router. The 3700, on the other hand, always reports 123 UDP as 'in use', although 123 TCP is fine and there are no other relevant devices or services running on the router or my network.