iptables rule with time constraint

[battu19921]

i have a issue with iptables.
i was applying iptables rule with time constraints.
syntax :
 iptables -I INPUT -m time --timestart 9:00 --timestop 18:00 -j DROP

and rule which was i am trying

iptables -I OUTPUT -p icmp -d 192 .168.0.101 -m time --timestart 9:00 --timestop 18:00 -j ACCEPT

And i also installed xtables-addons.

But above rule does not work properly.

Please can someone guide me how to resolve above issue.

[Philip D'Ath · Accepted solution]

Check out this guide:

http://www.cyberciti.biz/tips/iptables-for-restricting-access-by-time-of-day.html

Are you sure the machine itself has the correct time?

This isn't really a Cisco question ...

[battu19921]

yeah machine has the correct time.

[Philip D'Ath]

Looking at your line, you are telling it to "ACCEPT" the packets during this time.  Do you have a rule after this to block the traffic when it falls outside this time?

[battu19921]

yeah i have rule iptables -I OUTPUT -p icmp -j DROP.

Could u please tell me about xtables-addon ...

i think this issue occur due to kernel.

[Philip D'Ath]

I'm not sure.  I have never used xtables-addon.

[battu19921]

without xtables-addon how we can apply rule with time constraint.

[Philip D'Ath]

I use Ubuntu.  It doesn't mention in the man page for iptables-extensions having to load any extra modules.  It just says to reference it with "-m time".

I haven't used this feature myself.

[Philip D'Ath]

I just saw one article mentioning a kernel patch called Patch-O-Matic needs to be installed.  Presumably Ubuntu already has this integrated into the kernel.

[battu19921]

yeah you are right...

but in patch-o-matic we should compile kernel after every changes.

In xtables-addon we should compile only once..

And i am also using ubuntu but without patch-o-matic or xtables-addons rule does nt work.

[battu19921]

And  time module is not part of standard kernel, you need to download and apply patch from patch-o-matic or you need xtables-addon