Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to open all ports for specific user for specific length of time using IPtable. The current rule i have is:

$IPTABLES -A FORWARD -i $LAN_IF -o $OUTSIDE_IF -p tcp -s -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IF -o $OUTSIDE_IF -p udp -s -m state --state NEW -j ACCEPT

So, how can i specify length of time? eg. 7:00 am to 5:30 pm

share|improve this question
up vote 2 down vote accepted

With the --timestart and --timestop statements (in 24h time format):

$IPTABLES -A FORWARD -i $LAN_IF -o $OUTSIDE_IF -p tcp -s -m state --state NEW -j ACCEPT --timestart 7:00 --timestop 17:30

See man iptables

share|improve this answer

From the iptables() manpage one can learn that a time module exists which does what you want:

This matches if the packet arrival time/date is within a given range. All options are optional, but are ANDed when specified. All times are interpreted as UTC by default.

--datestart [YYY[-MM[-DD[Thh[:mm[:ss]]]]] --datestop YYYY[-MM[-DD[Thh[:mm[:ss]]]]] Only match during the given time, which must be in ISO 8601 "T" notation. The possible time range is 1970-01-01T00:00:00 to 2038-01-19T04:17:07. If --datestart or --datestop are not specified, it will default to 1970-01-01 and 2038-01-19, respectively. --timestart hh:mm[:ss] --timestop hh:mm[:ss] Only match during the given daytime. The possible time range is 00:00:00 to 23:59:59. Leading zeroes are allowed (e.g. "06:03") and correctly interpreted as base-10. [!] --monthdays day[,day...] Only match on the given days of the month. Possible values are 1 to 31. Note that specifying 31 will of course not match on months which do not have a 31st day; the same goes for 28- or 29-day February. [!] --weekdays day[,day...] Only match on the given weekdays. Possible values are Mon, Tue, Wed, Thu, Fri, Sat, Sun, or values from 1 to 7, respectively. You may also use two-character variants (Mo, Tu, etc.). --kerneltz Use the kernel timezone instead of UTC to determine whether a packet meets the time regulations. EXAMPLES. To match on weekends, use: -m time --weekdays Sa,Su Or, to match (once) on a national holiday block: -m time --datestart 2007-12-24 --datestop 2007-12-27 Since the stop time is actually inclusive, you would need the following stop time to not match the first second of the new day: -m time --datestart 2007-01-01T17:00 --datestop 2007-01-01T23:59:59 During lunch hour: -m time --timestart 12:30 --timestop 13:30 The fourth Friday in the month: -m time --weekdays Fr --monthdays 22,23,24,25,26,27,28
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.