As a sysadmin, you may be asked to control access to a couple of services based upon a day in time,
for example, the company intranet server should only be available from Monday to Friday between eight
a.m. and six p.m. in this lecture.
I'll show you how to filter traffic based on the date and time the packet is received, generated or
routed.
There is the minus empty time of mix that is very flexible and has many options like date, start date,
stop time, start time, stop month base and weekdays.
You can see all options by running IP tables, minus MPM minus minus help.
These are all options of minus time, Mitch.
Now to that by default, net filter uses UTC internat the system time.
On my computer, it's East European time, which means UTC plus two.
So the UTC hour is 14, not 16.
The minus minus casualties option makes a net filter.
Use the system time instead of UTC time, but pay attention.
I've seen different Linux distributions that used only UTC, even though kernel option was given.
Let's move to a terminal and take a look at some examples.
In the first example, I want to permit SSX traffic only between 10 a.m. and four p.m. on weekdays,
and in the second example, I want to allow access to a specific website only after working hours we
suppose that this machine is the router.
I'll create a script and write all IP table rules in that script.
First, we flash all changed because we executed the script many times and don't want the rules to be
added each time we execute the script.
We wanted to permit incoming SSX traffic only between 10:00 a.m. and 4:00 p.m. or 16 on weekdays, so
IP tables minus the input, minus B, DCB minus minus deport 22.
This is SSX traffic minus in time minus minus time start then Callon zero zero.
And minus minus time stop 16, column zero zero minus eight, accept.
Youth 24 hours format when writing the time.
And another angle that drops packets, if time is not between that time interval, this is necessary
only if the policy is set to accept.
In fact, it's the same rule, but without the miners in time.
Mitch.
This is the second rule.
And of course, the target is drop.
The rule on line number six will drop packages that haven't been accepted by the rule on line five.
I'm saving the script, then make it executable and run it.
From the other Linux host, I'll connect to the firewall using SSX.
And SSX is working, Bexxar permitted, I'm listing the five year old and we notice that 13 packets
have been accepted by the school, we are in that time interval.
Look how it used UTC and the not East European time, so in fact, it's 14, not 16 to test it properly,
I'll exchange the time when the whole of it accepts the traffic is active.
Let's say that the traffic will be permitted only between three and five a.m..
Three and times stop his five.
This is A.M. time I'm saving it and then run it again.
From Lennox to I try to connect using SSX to Linux one, and it's not working.
The rule of it accepts SSX traffic is not active at this time.
It's active only between three and five UTC.
We notice five dropped packets by the second rule.
Let's move on to the second desk, we want to allow access to a specific website, let's say www.youtube.com
only after working hours, this machine is there out there, and this is about the traffic and that
means the chain.
In the same script, I led a rule to force chain that makes his ETOPS traffic to www.youtube.com.
IP table is minus a fourth minus BTP minus minus the port, four for three, this is minus D w w w dot
Ubuntu dot com and now max related to time minus same time, minus minus time start.
Eighteen, this means six pm, UTC minus minus time stop eight zero zero minus G accept and the rule
that drops outgoing traffic to www.youtube.com this is the traffic that hasn't been accepted by the
first world.
This is the second call and it has the drop target.
If the destination IP address is the of the domain www.youtube.com and time is between 18 and eight,
the packet will be accepted, otherwise it will be dropped by the online 10.
I'm saving the script and the running it.
We noticed the rules that accept packages destined to the IP addresses of www.youtube.com between 18
and eight UTC and those that are dropping the traffic to the same domain name or the same IP addresses
if the time is not in that interval.