Problem with match extensions

Problem with match extensions

[Daniel Firvida]

Hi

I have a problem with match extensions of iptables, concretely with
match of time
I have kernel version 2.6.9, iptables version 1.3.4 and the patch
patch-o-matic-ng-20040621 but I not with himself that the conditions
of time are executed.

The rules..

iptables -I INPUT 1 -s 143.56.34.X -m time --timestop 22:30 -j DROP
iptables -I INPUT 2 -s 143.56.34.X -m conntrack --ctexpire 50 -j DROP
# iptables -L -n
DROP       all  --  143.56.34.X          0.0.0.0/0           TIME to
22:30 on all days
DROP       all  --  143.56.34.X          0.0.0.0/0           ctexpire 50
...

They are accepted correctly by the system, but they are not freed when
it corresponds.
The system ignores the time rule or ctexpire completely

Some solution/idea ?¿

Than you very much
A greeting

PD: escusme my bad english

Re: Problem with match extensions

[Rob Sterenborg]

On Mon, December 26, 2005 11:31, Daniel Firvida wrote:
> Hi
>
> I have a problem with match extensions of iptables, concretely with
> match of time
> I have kernel version 2.6.9, iptables version 1.3.4 and the patch
> patch-o-matic-ng-20040621

You have the latest iptables but you are using old kernel and POM
(more than a year old, kernel is at 2.6.14 and snapshot POM-ng is now
at 20051225).
Perhaps it would work when you switched to newer versions, at least
that of POM-ng (but a newer POM-ng may require a newer kernel..).

> but I not with himself that the conditions of time are executed.

I'm sorry, I don't understand what you mean here.


Gr,
Rob