0

I am using iptables v1.4.7/8.

I used the following command

iptables -A INPUT -s 10.0.4.247 -m time --utc  --datestart 2013-5-23T7 --datestop 2013-5-23T9 -j DROP

my utc time

date -u

Thu May 23 07:49:29 UTC 2013

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  10.0.4.247            anywhere            TIME starting from 2013-05-23 07:00:00 until date 2013-05-23 09:00:00 UTC

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

but how I can able to ping from the IP 10.0.4.247 after this command and I am doing with in the blocking time.

One more thing is my local time

date

Thu May 23 15:37:54 IST 2013

when i am giving follwing command it is able to block the traffic in the time even i specified --utc.

iptables -A INPUT -s 10.0.4.247 -m time --utc  --datestart 2013-5-23T7 --datestop 2013-5-23T15:38 -j DROP

successfuly blocked the traffic for the time given.

but I want it to check the UTC time not local time.how to do this.

kindly tell some answer.

4
  • 1
    Are you pinging from 10.0.4.247 or 10.0.4.27 ?
    – etagenklo
    Commented May 23, 2013 at 9:46
  • thanks for reply,sorry I have not mentioned the iptables rule is set in other machine ip:10.0.2.92.kindly tell some answer.
    – pradipta
    Commented May 23, 2013 at 10:00
  • 1
    Yes, but your inbound rule says -s 10.0.4.27 whereas you write "how I can able to ping from the IP 10.0.4.247". Of course you're able to ping from 10.0.4.247 when you block traffic from 10.0.4.27.
    – etagenklo
    Commented May 23, 2013 at 10:02
  • I have changed the question ,I have wrongly given the ip 10.0.4.27,It is 10.0.4.247.Now also I am not able to block the traffic.One more thing i found kilndy see the question.
    – pradipta
    Commented May 23, 2013 at 10:11

1 Answer 1

1

It looks like the --utc flag takes into account the hardware clock's tz.tz_minuteswest. I need to research further, but it seems to be that way in practice

# hwclock --systz --debug 
hwclock from util-linux-ng 2.17.2
Last drift adjustment done at 1396716845 seconds after 1969
Last calibration done at 1396716845 seconds after 1969
Hardware clock is on UTC time
Assuming hardware clock is kept in UTC time.
Current system time: 1414455370 = 2014/10/28 00:16:10
Calling settimeofday:
    UTC: 2014/10/28 00:16:10
    tv.tv_sec = 1414455370, tv.tv_usec = 262714
    tz.tz_minuteswest = 300

What worked for me was calculating what UTC minus tz.tz_minuteswest to create my rules

# date
Mon Oct 27 19:07:28 CDT 2014

# iptables -A cphulk -s 10.4.80.2/32 -m state --state NEW -m time  --datestop 2014-10-27T19:08:55 --utc -j DROP
# iptables -vnL cphulk
Chain cphulk (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  130  7360 DROP       all  --  *      *       10.4.80.2            0.0.0.0/0           state NEW TIME until date 2014-10-27 19:08:55 UTC 

# date
Mon Oct 27 19:09:07 CDT 2014
# iptables -vnL cphulk
Chain cphulk (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  130  7360 DROP       all  --  *      *       10.4.80.2            0.0.0.0/0           state NEW TIME until date 2014-10-27 19:08:55 UTC

I assume it uses the tz.tz_minutewest to keep up with DST. Notice the change from 300 to 360

# date 11030544
Mon Nov  3 05:44:00 CST 2014
# hwclock --systz --debug  | grep tz_minuteswest
    tz.tz_minuteswest = 360

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .