Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 5 down vote favorite
3

Someone told me this is possible, but I can't find anything on google or man pages.

I need to ban IPs for a certain amount of time, and then have then unbanned automatically.

share|improve this question

5 Answers

up vote 7 down vote accepted

If you mean for iptables to completely remove the rule by itself you won't be able to do it, as far as I know. What's the purpose of this? If you need some kind of automatic temporary banning the standard solution is fail2ban.

Alternatively you can use a cron job to remove the rule you're adding, or, better if you want to do it interactively, an at job:

iptables -I INPUT -s 192.168.1.100 -j DROP
echo "iptables -D INPUT -s 192.168.1.100 -j DROP" | at @10pm

Also take a look at the recent module of iptables. This with its --seconds option may be of help, depending on your actual needs. man iptables for more information.

share|improve this answer
oh wow the 'at' job looks great. Can I combine it with nohup and &? How? – HappyDeveloper May 24 '11 at 18:40
No need to use nohup - the at job is executed independently from the terminal you used to create it. This means it's run in a shell that doesn't inherit your environment variables, by the way, and it's /bin/sh by default. But that probably won't be a problem in this case. – Eduardo Ivanec May 24 '11 at 18:43
up vote 6 down vote

Put a comment with a timestamp (probably seconds since the epoch) in the rules. Periodically sweep for expired rules.

Note that the most recent linux kernel has support for dynamic loading of IPs into a cache consulted by iptable rules instead of as direct iptables rules.

Example:

iptables  -A INPUT -s 192.168.200.100/32 -m comment --comment "expire=`date -d '+ 5 min' +%s`" -j DROP 
iptables -L INPUT -n --line-numbers  | perl -ne 'next unless /(^\d+).*expire=(\d+)/; if ($2 < time) { print "iptables -D INPUT $1\n"; }'

You can of course iptables -D INPUT $1 instead of printing the command.

share|improve this answer
great idea. Not sure how to do the sweeping part though, I'll be thinking.. – HappyDeveloper May 24 '11 at 18:44
+1 Very good idea, maybe not the simplest but definitely neat. – Kyle Smith May 24 '11 at 18:45
@HappyDeveloper: Provided example for add/sweep – Seth Robertson May 24 '11 at 18:58
Haha I just had to do this as well, I used awk for my cleanup: iptables -L FORWARD --line-numbers | sort -r | awk 'substr($8,1,4) == "exp@" && substr($8,5) < systime() { systems("iptables -D FORWARD " $1) }' where rules are made like: iptables -A FORWARD -j DROP -m comment --comment "exp@EPOCH" – Kyle Smith May 24 '11 at 19:00
up vote 1 down vote

You can use fail2ban to ban ip addresses and configure the length of time an address will be banned for.

share|improve this answer
up vote 1 down vote

IPTables has a feature made expressly for this: IP Set. You make the rule once and it persists as usual but it checks in a set of ips (or ports) for matches. The cool thing is that this set can be dynamically and efficiently updated without disturbing the rest of the firewall.

The main website, examples.

So, to use it, you would still have to use at or cron to schedule the removal.

share|improve this answer
up vote 0 down vote

Depending on what exactly you want to accomplish the either the netfilter recent or time modules could be used to accomplish this.

Both are documented in the iptables man page.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.