I would like to give an ip access to tcp port 3306 for an hour. After that, all connections must be closed.

How can i add a timeout to the following expression?

iptables -A INPUT -m state --state NEW -m tcp -p tcp --source --dport 3306 -j ACCEPT

I believe (I've never used it, and found it through the iptables man page) --timestart and --timestop will accomplish this.

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --source --dport 3306 --timestart 13:00 --timestop 14:00 -j ACCEPT

Would allow you between 1 and 2pm.

This matches if the packet arrival time/date is within a given range. All options are facultative.

--timestart value

Match only if it is after 'value' (Inclusive, format: HH:MM ; default 00:00).

--timestop value

Match only if it is before 'value' (Inclusive, format: HH:MM ; default 23:59).

  • 2
    Will this terminate established connections (which is what I believe JMW is asking for)? – voretaq7 Sep 21 '11 at 14:31
  • active connections do not get disconnected, but this is working: iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --source --dport 3306 --timestart 13:00 --timestop 14:00 -j ACCEPT – JMW Sep 21 '11 at 14:48
  • @JMW Thanks, I updated my answer to include your edit. – Jason Taylor Sep 21 '11 at 15:00
  • 1
    Depending on what rules are already in firewall this will probably not work since you use append rule (-A) – Hrvoje Špoljar Sep 21 '11 at 15:03
  • if you wanted to terminate connections; you could add an explicit -j REJECT --reject-with tcp-reset for all connections falling outside of the time slot – Olipro Sep 21 '11 at 15:13

Alternative solution that does not require iptables time module supported.

( iptables -I INPUT -p tcp -s --dport 3306 -j ACCEPT ; sleep 1h; iptables -D INPUT -p tcp -s --dport 3306 -j ACCEPT ) &

This won't close the connections after hour, it will simply return to whatever policy was before allowing the connection; which can be setup to interrupt and drop/reject the no longer allowed traffic unless you have STATE ESTABLISHED ALLOW beforehand.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.