Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to give an ip access to tcp port 3306 for an hour. After that, all connections must be closed.

How can i add a timeout to the following expression?

iptables -A INPUT -m state --state NEW -m tcp -p tcp --source --dport 3306 -j ACCEPT
share|improve this question
up vote 3 down vote accepted

I believe (I've never used it, and found it through the iptables man page) --timestart and --timestop will accomplish this.

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --source --dport 3306 --timestart 13:00 --timestop 14:00 -j ACCEPT

Would allow you between 1 and 2pm.

This matches if the packet arrival time/date is within a given range. All options are facultative.

--timestart value

Match only if it is after 'value' (Inclusive, format: HH:MM ; default 00:00).

--timestop value

Match only if it is before 'value' (Inclusive, format: HH:MM ; default 23:59).

share|improve this answer
Will this terminate established connections (which is what I believe JMW is asking for)? – voretaq7 Sep 21 '11 at 14:31
active connections do not get disconnected, but this is working: iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --source --dport 3306 --timestart 13:00 --timestop 14:00 -j ACCEPT – JMW Sep 21 '11 at 14:48
@JMW Thanks, I updated my answer to include your edit. – Jason Taylor Sep 21 '11 at 15:00
Depending on what rules are already in firewall this will probably not work since you use append rule (-A) – Hrvoje Špoljar Sep 21 '11 at 15:03
if you wanted to terminate connections; you could add an explicit -j REJECT --reject-with tcp-reset for all connections falling outside of the time slot – Olipro Sep 21 '11 at 15:13

Alternative solution that does not require iptables time module supported.

( iptables -I INPUT -p tcp -s --dport 3306 -j ACCEPT ; sleep 1h; iptables -D INPUT -p tcp -s --dport 3306 -j ACCEPT ) &

This won't close the connections after hour, it will simply return to whatever policy was before allowing the connection; which can be setup to interrupt and drop/reject the no longer allowed traffic unless you have STATE ESTABLISHED ALLOW beforehand.

share|improve this answer
thanks :-) this is also a great solution – JMW Sep 21 '11 at 15:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.