time modules

time modules

[vlad]

Hello netfilter,

iptables -I INPUT 1 -p tcp -s 192.168.1.2/32 -m time --timestart \
11:00 --timestop 17:00 --days Sun,Mon,Tue,Wed,Thu,Fri,Sat \
-d 192.168.1.1/32 --j DROP  
Defaul policy in INPUT chain - DROP
But... packets allows to 192.168.1.240 (server) in this
time --> 11:00-17:00.

Why?

-- 
With best wishes,
 vlad                          mailto:faktadmin@mail.ru

----------------------------------------------

time modules

[netfilter-maillist]

Hello

iptables -I INPUT 1 -p tcp -s 192.168.1.2/32 -m time --timestart \
11:00 --timestop 17:00 --days Sun,Mon,Tue,Wed,Thu,Fri,Sat \
-d 192.168.1.1/32 --j DROP  
Defaul policy in INPUT chain - DROP
But... packets allows to 192.168.1.240 (server) in this
time --> 11:00-17:00.

Why?

-- 
With best wishes,
 netfilter-maillist                          mailto:vlad@fakt.tazovsky.ru

Re: time modules

[Raymond Leach]

[-- Attachment #1: Type: text/plain, Size: 1281 bytes --]

If you use SNAT (masquerade) then it may be bypassing the input chain
because of a prerouting rule ...

On Tue, 2003-03-18 at 09:24, netfilter-maillist wrote:
> Hello
> 
> iptables -I INPUT 1 -p tcp -s 192.168.1.2/32 -m time --timestart \
> 11:00 --timestop 17:00 --days Sun,Mon,Tue,Wed,Thu,Fri,Sat \
> -d 192.168.1.1/32 --j DROP  
> Defaul policy in INPUT chain - DROP
> But... packets allows to 192.168.1.240 (server) in this
> time --> 11:00-17:00.
> 
> Why?
-- 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(  Raymond Leach                       )
 ) Knowledge Factory                  (
(                                      )
 ) Tel: +27 11 445 8100               (
(  Fax: +27 11 445 8101                )
 )                                    (
(  http://www.knowledgefactory.co.za/  )
 ) http://www.saptg.co.za/            (
(  http://www.mapnet.co.za/            )
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   o                                o
    o                              o
        .--.                  .--.
       | o_o|                |o_o |
       | \_:|                |:_/ |
      / /   \\              //   \ \
     ( |     |)            (|     | )
     /`\_   _/'\          /'\_   _/`\
     \___)=(___/          \___)=(___/


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: time modules

[Fabrice MARIE]

Hi Vladimir,

On Tuesday 18 March 2003 15:17, vlad wrote:
> Hello netfilter,
> iptables -I INPUT 1 -p tcp -s 192.168.1.2/32 -m time --timestart \
> 11:00 --timestop 17:00 --days Sun,Mon,Tue,Wed,Thu,Fri,Sat \
> -d 192.168.1.1/32 --j DROP
> Defaul policy in INPUT chain - DROP
> But... packets allows to 192.168.1.240 (server) in this
> time --> 11:00-17:00.
> Why?

With a quick guess, two reasons come to mind:
1- you have an ACCEPT rule that shadows the -m time -j DROP rule,
   therefore nullifying its effect.
2- the packets that you talk about still being allowed might be from
   a forwarding connection ? In which case you have to filter in
   forward chain.

To see if 1 is your problem, simply put the rule -m time -j DROP at
the _begining_ of the ruleset, this way you'll be sure it won't be shadowed
by other rules.

To see if 2 is your problem, simply put the rule -m time -j DROP in
the FORWARD chain instead.

Have a nice day,

Fabrice.
--
Fabrice MARIE

"Silly hacker, root is for administrators"
       -Unknown