1

I would like to give an ip access to tcp port 3306 for an hour. After that, all connections must be closed.

How can i add a timeout to the following expression?

iptables -A INPUT -m state --state NEW -m tcp -p tcp --source 1.2.3.4 --dport 3306 -j ACCEPT
Improve this question

2 Answers 2

Reset to default
3

I believe (I've never used it, and found it through the iptables man page) --timestart and --timestop will accomplish this.

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --source 1.2.3.4 --dport 3306 --timestart 13:00 --timestop 14:00 -j ACCEPT

Would allow you between 1 and 2pm.

This matches if the packet arrival time/date is within a given range. All options are facultative.

--timestart value

Match only if it is after 'value' (Inclusive, format: HH:MM ; default 00:00).

--timestop value

Match only if it is before 'value' (Inclusive, format: HH:MM ; default 23:59).

Improve this answer
5
  • 2
    Will this terminate established connections (which is what I believe JMW is asking for)?
    – voretaq7
    Sep 21, 2011 at 14:31
  • active connections do not get disconnected, but this is working: iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --source 1.2.3.4 --dport 3306 --timestart 13:00 --timestop 14:00 -j ACCEPT
    – JMW
    Sep 21, 2011 at 14:48
  • @JMW Thanks, I updated my answer to include your edit.
    – Jason Taylor
    Sep 21, 2011 at 15:00
  • 1
    Depending on what rules are already in firewall this will probably not work since you use append rule (-A)
    – Hrvoje Špoljar
    Sep 21, 2011 at 15:03
  • if you wanted to terminate connections; you could add an explicit -j REJECT --reject-with tcp-reset for all connections falling outside of the time slot
    – Olipro
    Sep 21, 2011 at 15:13
2

Alternative solution that does not require iptables time module supported.

( iptables -I INPUT -p tcp -s 1.2.3.4 --dport 3306 -j ACCEPT ; sleep 1h; iptables -D INPUT -p tcp -s 1.2.3.4 --dport 3306 -j ACCEPT ) &

This won't close the connections after hour, it will simply return to whatever policy was before allowing the connection; which can be setup to interrupt and drop/reject the no longer allowed traffic unless you have STATE ESTABLISHED ALLOW beforehand.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .