Home / server / Questions / 498738
Accepted
Achu
Asked: 2013-04-13 03:38:58 +0800 CST

How to open all ports for specific length of time?

  • 772

I'd like to open all ports for specific user for specific length of time using IPtable. The current rule i have is: 

$IPTABLES -A FORWARD -i $LAN_IF -o $OUTSIDE_IF -p tcp -s 192.168.10.34 -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IF -o $OUTSIDE_IF -p udp -s 192.168.10.34 -m state --state NEW -j ACCEPT

So, how can i specify length of time? eg. 7:00 am to 5:30 pm

debian

2 Answers

  1. Best Answer

    With the --timestart and --timestop statements (in 24h time format): 

    $IPTABLES -A FORWARD -i $LAN_IF -o $OUTSIDE_IF -p tcp -s 192.168.10.34 -m state --state NEW -j ACCEPT --timestart 7:00 --timestop 17:30

    See man iptables

    • 2

  2. From the iptables() manpage one can learn that a time module exists which does what you want:

    
time
    
       This matches if the packet arrival time/date is within a given range. All
options are optional, but are ANDed when specified. All times are interpreted as UTC
by default.                 
    

   --datestart [YYY[-MM[-DD[Thh[:mm[:ss]]]]]
   --datestop YYYY[-MM[-DD[Thh[:mm[:ss]]]]]
          Only match during the given time, which must be in ISO 8601 "T" notation.  The possible time range is 1970-01-01T00:00:00 to 2038-01-19T04:17:07.        
          If --datestart or --datestop are not specified, it will default to 1970-01-01 and 2038-01-19, respectively.

   --timestart hh:mm[:ss]   
   --timestop hh:mm[:ss]    
          Only match during the given daytime. The possible time range is 00:00:00 to 23:59:59. Leading zeroes are allowed (e.g. "06:03") and correctly interpreted as base-10.               

   [!] --monthdays day[,day...] 
          Only  match on the given days of the month. Possible values are 1 to 31. Note that specifying 31 will of course not match on months which do not have a 31st day; the same goes for 28- or 29-day February.                                                

   [!] --weekdays day[,day...]  
          Only match on the given weekdays. Possible values are Mon, Tue, Wed, Thu, Fri, Sat, Sun, or values from 1 to 7, respectively. You may also use two-character variants (Mo, Tu, etc.).

       --kerneltz
          Use the kernel timezone instead of UTC to determine whether a packet meets the time regulations.    

   EXAMPLES. To match on weekends, use:
          -m time --weekdays Sa,Su

   Or, to match (once) on a national holiday block:      
          -m time --datestart 2007-12-24 --datestop 2007-12-27

   Since the stop time is actually inclusive, you would need the following stop time to not match the first second of the new day:

          -m time --datestart 2007-01-01T17:00 --datestop 2007-01-01T23:59:59

   During lunch hour:

          -m time --timestart 12:30 --timestop 13:30

   The fourth Friday in the month:

          -m time --weekdays Fr --monthdays 22,23,24,25,26,27,28
    • 2