Hello friends,
I have a simple firewall rule ""chain=forward action=drop protocol=tcp in-interface=vlan202_1LYK dst-port=25,587,465 time=8h-10h,sun,mon,tue,wed,thu,fri,sat log=no
log-prefix=""
I want this rule to be applied for the same ours but for different days for example in mon,wed,fri
The problem is that if i choose, lets say these 3 days, the rule doesn't become active. If it is monday 08:20 the rule still says inactive time, on wed it says the same.
It only works if i tik all of the days, but i don't want that!!!
The system clock is synchronized.
Anybody have an idea?
-
-
JohnTRIVOLTA
Member
- Posts: 345
- Joined:
- Location: BG/Sofia
Re: Time Based firewaal rules
Synchronize time on routerboard with ntp client or manually ?
Re: Time Based firewaal rules
Can you give us one particular example?
I just checked with the quick firewall and ICMP drop, everything works how it should.
I just checked with the quick firewall and ICMP drop, everything works how it should.
Re: Time Based firewaal rules
With ntp client!!!Synchronize time on routerboard with ntp client or manually ?
Re: Time Based firewaal rules
For example i want that rule to be applied tomorrow Friday 07 June and Sunday 9 June on the same time (08:00 - 10:00) . If i check fri and sun, when time has reached 08:01 it sould become active, but it doesn't!!! Only if i check all of the days then it becomes active on Fri at 08:01. It's crazy!!!Can you give us one particular example?
I just checked with the quick firewall and ICMP drop, everything works how it should.
I hope you undestood my example!!
Re: Time Based firewaal rules
I have never had any time based firewall rules, but because of this thread, I created one for a test. The rule was a simple rule to drop all ICMP packets from the internet at the beginning of my Input chain with no time restriction. I am not at the location of this router, so my access is only via the internet. I then started a continuous ping from another computer. As soon as I enabled the rule, pings started failing. This was expected, but I wanted to verify that the rule was working. I then modified the rule to add a time restriction from 14:00:00 until 14:05:00 on Thursday. WinBox correctly showed the rule as inactive time. A few minutes later, 14:00:00 rolled around and WinBox showed the rule active and the pings started failing. At 14:05:00, WinBox then showed the rule as inactive time and the pings started working.
Just for good measure, I modified the rule again to have a time restriction of 14:15:00 - 14:16:00 on Sunday, Tuesday, Thursday, and Saturday. It worked perfectly.
Test performed on a RB-750Gr3 running ROS 6.44.1
Just for good measure, I modified the rule again to have a time restriction of 14:15:00 - 14:16:00 on Sunday, Tuesday, Thursday, and Saturday. It worked perfectly.
Test performed on a RB-750Gr3 running ROS 6.44.1
-
-
JohnTRIVOLTA
Member
- Posts: 345
- Joined:
- Location: BG/Sofia
Re: Time Based firewaal rules
NTP . In ROS this is System-SNTP client .With ntp client!!!Synchronize time on routerboard with ntp client or manually ?
Re: Time Based firewaal rules
Thank you for the example and that is the way it should work. Unfortunately it doesn't happen to me. My rule which is as simple as yours becomes active only when i check all days. I don't know why yet but i will find out!!!!! Thanks for the try!!!!!I have never had any time based firewall rules, but because of this thread, I created one for a test. The rule was a simple rule to drop all ICMP packets from the internet at the beginning of my Input chain with no time restriction. I am not at the location of this router, so my access is only via the internet. I then started a continuous ping from another computer. As soon as I enabled the rule, pings started failing. This was expected, but I wanted to verify that the rule was working. I then modified the rule to add a time restriction from 14:00:00 until 14:05:00 on Thursday. WinBox correctly showed the rule as inactive time. A few minutes later, 14:00:00 rolled around and WinBox showed the rule active and the pings started failing. At 14:05:00, WinBox then showed the rule as inactive time and the pings started working.
Just for good measure, I modified the rule again to have a time restriction of 14:15:00 - 14:16:00 on Sunday, Tuesday, Thursday, and Saturday. It worked perfectly.
Test performed on a RB-750Gr3 running ROS 6.44.1
Re: Time Based firewaal rules
I figured it out!! You have to specify the time and day or days that you want the rule to be applied and then you have to press reset all counters to reset everything and allow the new rule to be applied. I checked it 3-4 times and it worked fine.
Thank you all!!!!
Thank you all!!!!
Re: Time Based firewaal rules
I definitely did not have to reset counters to make it work. What hardware and ROS version?I figured it out!! You have to specify the time and day or days that you want the rule to be applied and then you have to press reset all counters to reset everything and allow the new rule to be applied. I checked it 3-4 times and it worked fine.
Thank you all!!!!
Re: Time Based firewaal rules
6.43.11 CRS125-24G-1SI definitely did not have to reset counters to make it work. What hardware and ROS version?I figured it out!! You have to specify the time and day or days that you want the rule to be applied and then you have to press reset all counters to reset everything and allow the new rule to be applied. I checked it 3-4 times and it worked fine.
Thank you all!!!!
-
-
CZFan
Forum Guru
- Posts: 2098
- Joined:
- Location: South Africa, Krugersdorp (Home town of Brad Binder)
- Contact:
Re: Time Based firewaal rules
I figured it out!! You have to specify the time and day or days that you want the rule to be applied and then you have to press reset all counters to reset everything and allow the new rule to be applied. I checked it 3-4 times and it worked fine.
Thank you all!!!!
I suspect that you have a rule before this one that accepted established / related and packets did not reach your "time based" rule, by resetting all counters, it probably re initiated all rules which caused "new" connections to reach the time rule.
Difficult to say without seeing rest of firewall config.
Re: Time Based firewaal rules
This would be a bug too. Resetting rule counters has normally nothing to do with removing connections.I suspect that you have a rule before this one that accepted established / related and packets did not reach your "time based" rule, by resetting all counters, it probably re initiated all rules which caused "new" connections to reach the time rule.