[More Question] TIMEBLOCK

[More Question] TIMEBLOCK

[wizard]

 I still have a question about timeblock,

 I use timeblock with crontab. and  there is some problem with this method.

 for example

 1) there is a rule that  netfiler with conntrack accept packet from
10.0.0.1 to 10.0.1.1 on the term from 6 AM to 7 AM.(on top of FORWARD chain
, there is rule for Established and Related packet ACCEPTING.

 2) there is a connection on 6:30 AM, and user continue his job with telnet
,so conntrack entry is not destroyed from timeout.

 3) When it is past 7 AM , the rule acceping telnet will be vanished by
crond , but telnet session will be survive, because of it's session and
 the rule accepting Established packet.


 so. I cannot apply drop rule immidatly for the connection  which is
accepted before , until connection entry is destory by the kernel timer.

 I want to apply drop rule to the connection still using.

 how can i do this  sustaining the Established accept rule on the top of
FORWARD chain?

Re: [More Question] TIMEBLOCK

[Patrick Schaaf]

>  3) When it is past 7 AM , the rule acceping telnet will be vanished by
> crond , but telnet session will be survive, because of it's session and
>  the rule accepting Established packet.

Who is forcing you to accept any established packet???

>  I want to apply drop rule to the connection still using.

A real drop would probably keep the conntrack entry sitting there
for a long time, so I would propose you use REJECT, instead, so
the endpoints of a TCP connection have a chance to notice your
timely hostility when it happens.

>  how can i do this  sustaining the Established accept rule on the top of
> FORWARD chain?

Again, who is forcing you to have an unconditional 'established' rule
on top of your forward chain?

I hope this could help you. If not, please ask again on the user mailing
list. This is no development question, all the features you need are
alreay there.

best regards
  Patrick

-- 
By the way, I'm all for Koreans learning iptables.