I'm not sure if that can be done with the netfilter itself. You could always get a script into crontab to check if the rule is matched (iptables ... -L -n -v will show you number of packets matched by the rule) and set up some sort of a timer.

Ivan

Quoted 15 lines · Colin Davis

Hi,
Not sure if this is possible. I wish to create a rule that once created will automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Colin Davis

author

2009-02-19 17:42 UTC #3 lore raw

Thanks Ivan, I was hoping to be able to do this directly using a rule without writing a script / using cron but looks like that's what I'm going to have to do.

Colin.

Quoted 24 lines · Ivan Petrushev

I'm not sure if that can be done with the netfilter itself. You could always get a script into crontab to check if the rule is matched (iptables ... -L -n -v will show you number of packets matched by the rule) and set up some sort of a timer.
Ivan
Quoted 15 lines · Colin Davis
Hi,
Not sure if this is possible. I wish to create a rule that once created will automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Peter Renzland

2009-02-19 17:56 UTC #4 lore raw

I would write a simple script "ipoff NN" which takes the same arguments as iptables (after NN), converts -I and -A to -D, etc, and sleeps NN minutes before doing the cancel.

Then, after running the command that sets up the rule, I would just arrow up and change iptables to ipoff NN. That would be *very usable*, IMHO.

(I most definitely would not use cron or at, since those tools do not naturally match the problem at all.)

Peter

Quoted 39 lines · Colin Davis

Thanks Ivan, I was hoping to be able to do this directly using a rule without writing a script / using cron but looks like that's what I'm going to have to do.
Colin.
Quoted 5 lines · Ivan Petrushev
I'm not sure if that can be done with the netfilter itself. You could always get a script into crontab to check if the rule is matched (iptables ... -L -n -v will show you number of packets matched by the rule) and set up some sort of a timer.
Quoted 19 lines
Ivan
Quoted 15 lines · Colin Davis
Hi,
Not sure if this is possible. I wish to create a rule that once created will automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Colin Davis

author

2009-02-19 18:14 UTC #5 lore raw

Thanks Peter, definitely pointed me in a better direction.

Colin.

Quoted 53 lines · Peter Renzland

I would write a simple script "ipoff NN" which takes the same arguments as iptables (after NN), converts -I and -A to -D, etc, and sleeps NN minutes before doing the cancel.
Then, after running the command that sets up the rule, I would just arrow up and change iptables to ipoff NN. That would be *very usable*, IMHO.
(I most definitely would not use cron or at, since those tools do not naturally match the problem at all.)
Peter
Quoted 39 lines · Colin Davis
Thanks Ivan, I was hoping to be able to do this directly using a rule without writing a script / using cron but looks like that's what I'm going to have to do.
Colin.
Quoted 24 lines · Ivan Petrushev
I'm not sure if that can be done with the netfilter itself. You could always get a script into crontab to check if the rule is matched (iptables ... -L -n -v will show you number of packets matched by the rule) and set up some sort of a timer.
Ivan
Quoted 15 lines · Colin Davis
Hi,
Not sure if this is possible. I wish to create a rule that once created will automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
Signature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Signature · 3 lines
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Peter Renzland

2009-02-19 18:15 UTC #6 lore raw

In reply to Peter Renzland

On second thought:

iptemp NN ...
where ... are the iptables arguments

or, if needed very occasionally, do it "by hand":

run the rule,
arrow up, append ")&", arrow left to ... change -I (etc) to -D (etc), prepend "(sleep nnn;"

Peter

Quoted 58 lines · Peter Renzland

I would write a simple script "ipoff NN" which takes the same arguments as iptables (after NN), converts -I and -A to -D, etc, and sleeps NN minutes before doing the cancel.
Then, after running the command that sets up the rule, I would just arrow up and change iptables to ipoff NN. That would be *very usable*, IMHO.
(I most definitely would not use cron or at, since those tools do not naturally match the problem at all.)
Peter
Quoted 34 lines · Colin Davis
Thanks Ivan, I was hoping to be able to do this directly using a rule without writing a script / using cron but looks like that's what I'm going to have to do.
Colin.
Quoted 5 lines · Ivan Petrushev
I'm not sure if that can be done with the netfilter itself. You could always get a script into crontab to check if the rule is matched (iptables ... -L -n -v will show you number of packets matched by the rule) and set up some sort of a timer.
Quoted 19 lines
Ivan
Quoted 15 lines · Colin Davis
Hi,
Not sure if this is possible. I wish to create a rule that once created will automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 5 lines
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Ivan Petrushev

2009-02-19 18:17 UTC #7 lore raw

In reply to Peter Renzland

You will have a daemon hanging in background. If it happens to be killed your rule will not be removed from iptables. Besides that it is a nice solution, but I think cron plus a decent script does really solves the problem fine.

Quoted 65 lines · Peter Renzland

I would write a simple script "ipoff NN" which takes the same arguments as iptables (after NN), converts -I and -A to -D, etc, and sleeps NN minutes before doing the cancel.
Then, after running the command that sets up the rule, I would just arrow up and change iptables to ipoff NN.
That would be *very usable*, IMHO.
(I most definitely would not use cron or at, since those tools do not naturally match the problem at all.)
Peter
Quoted 37 lines · Colin Davis
Thanks Ivan, I was hoping to be able to do this directly using a rule without writing a script / using cron but looks like that's what I'm going to have to do.
Colin.
Quoted 6 lines · Ivan Petrushev
I'm not sure if that can be done with the netfilter itself. You could always get a script into crontab to check if the rule is matched (iptables ... -L -n -v will show you number of packets matched by the rule) and set up some sort of a timer.
Quoted 21 lines
Ivan
Quoted 16 lines · Colin Davis
Hi,
Not sure if this is possible. I wish to create a rule that once created will
automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 5 lines
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Gilad Benjamini

2009-02-19 18:18 UTC #8 lore raw

In reply to Peter Renzland

One thing to note is that you actually delete the exact same rule you added. There is no built-in method to do that.
I can think of a few ideas how to verify that (with high probability, not 100%) but it really depends on the actual requirements.

Quoted 75 lines

-----Original Message-----
From: [email protected] [mailto:netfilter- [email protected]] On Behalf Of Peter Renzland
Sent: Thursday, February 19, 2009 9:57 AM
To: Colin Davis
Cc: [email protected]
Subject: Re: iptables - how to create a rule that expires automatically
I would write a simple script "ipoff NN" which takes the same arguments as iptables (after NN), converts -I and -A to -D, etc, and sleeps NN minutes before doing the cancel.
Then, after running the command that sets up the rule, I would just arrow up and change iptables to ipoff NN.
That would be *very usable*, IMHO.
(I most definitely would not use cron or at, since those tools do not naturally match the problem at all.)
Peter
Quoted 39 lines · Colin Davis
Thanks Ivan, I was hoping to be able to do this directly using a rule without writing a script / using cron but looks like that's what I'm going
to have to do.
Colin.
Quoted 6 lines · Ivan Petrushev
I'm not sure if that can be done with the netfilter itself. You could always get a script into crontab to check if the rule is matched (iptables ... -L -n -v will show you number of packets matched
by the rule) and set up some sort of a timer.
Quoted 22 lines
Ivan
Quoted 17 lines · Colin Davis
Hi,
Not sure if this is possible. I wish to create a rule that once created will
automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 6 lines
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Gilad Benjamini

2009-02-19 17:48 UTC #9 lore raw

In reply to Colin Davis

A script, possibly with crontab or at, is your best bet.
For some scenarios it might be easier to use the "condition" match, and have your script change the proc value rather than the actual chain.

Quoted 22 lines

-----Original Message-----
From: [email protected] [mailto:netfilter- [email protected]] On Behalf Of Colin Davis
Sent: Thursday, February 19, 2009 9:11 AM
To: [email protected]
Subject: iptables - how to create a rule that expires automatically
Hi,
Not sure if this is possible. I wish to create a rule that once created will
automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

G.W. Haywood

2009-02-19 18:36 UTC #10 lore raw

In reply to Colin Davis

Hi there,

Quoted 2 lines · Colin Davis

Not sure if this is possible. I wish to create a rule that once created will automatically expire (and be removed) after say 10 minutes.

You can do it with iptree, part of ipset.

73,
Ged.

Mart Frauenlob

2009-02-20 09:01 UTC #11 lore raw

In reply to Colin Davis

Quoted 8 lines · [email protected] wrote:

Not sure if this is possible. I wish to create a rule that once created will automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.

Hello,

you did not tell much about your circumstances, but maybe worth taking a look at fail2ban:
http://www.fail2ban.org

As it's main goal seems to temporarily lock out certain hosts.

Greets

Mart

Michael Schwartzkopff

2009-02-20 09:16 UTC #12 lore raw

Am Freitag, 20. Februar 2009 10:01:37 schrieb Mart Frauenlob:

Quoted 18 lines

Quoted 8 lines · [email protected] wrote:
Not sure if this is possible. I wish to create a rule that once created will
automatically expire (and be removed) after say 10 minutes.
Please
Many thanks,
Colin.
Hello,
you did not tell much about your circumstances, but maybe worth taking a look at fail2ban:
http://www.fail2ban.org
As it's main goal seems to temporarily lock out certain hosts.

Quoted 7 lines

Greets
Mart
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Or you could utilize the recent module. see man iptables for more info about recent.

Signature · 18 lines

Dr. Michael Schwartzkopff
MultiNET Services GmbH
Addresse: Bretonischer Ring 7; 85630 Grasbrunn; Germany
Tel: +49 - 89 - 45 69 11 0
Fax: +49 - 89 - 45 69 11 21
mob: +49 - 174 - 343 28 75

mail: [email protected]
web: www.multinet.de

Sitz der Gesellschaft: 85630 Grasbrunn
Registergericht: Amtsgericht München HRB 114375
Geschäftsführer: Günter Jurgeneit, Hubert Martens

---

PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B
Skype: misch42