4

I would like to e.g. block certain traffic between 00:00 and 04:00. Is this possible in nftables?

(Obviously I can just set a cron job that changes the config at these times - but I would like to know if there is a nftables "native" way of achieving this.)

1 Answer 1

3

There are recent patches allowing to do just that, but they are not yet available in any release.

Here are the relevant patches (but they are part of series, they would probably not be enough te be applied by themselves).

linux kernel:
[v5,2/2] netfilter: nft_meta: support for time matching

libnftnl (userland low level nftables library):
[libnftnl,v2,1/2] expr: meta: Make NFT_META_TIME_{NS,DAY,HOUR} known

nftables (userland command):
[nft,2/4] meta: Introduce new conditions 'time', 'day' and 'hour'

Some usage examples:

  time < "2019-06-06 17:00" drop;
  time < "2019-06-06 17:20:20" drop;
  time < 12341234 drop;
  day "Saturday" drop;
  day 6 drop;
  hour >= 17:00 drop;
  hour >= "17:00:01" drop;
  hour >= 63000 drop;

[...]
We swap left and right values in a range to properly handle cross-day hour ranges (e.g. 23:15-03:22).

While the kernel patch was submitted on 2019-08-17, it had to go through nf-next, net-next and was merged for 5.4-rc1 on 2019-09-18. Kernel 5.4 should probably be out in a few weeks.

So according to the example above, while I couldn't test it yet, this should probably be a method to drop incoming connections to the local mail server between 00:00 and 04:00, once running with kernel 5.4, libnftnl 1.1.5? and nftables 0.9.3?:

#!/usr/sbin/nft -f

table inet filter {
    chain input {
        type filter hook input priority 0; policy accept;
        tcp dport 25 hour 00:00-04:00 drop
    }
}
5
  • 1
    Is something like this (timestamp / 1800) mod 2 in nftables possible, i.e. to produce values 0 and 1 alternating every half hour?
    – mvorisek
    Commented Dec 18, 2019 at 15:17
  • @Mvorisek I don't think this is implemented. mod is available only with numgen. And there's no division available anywhere. You can still use 48 rules or find a cleaner way using sets, maybe.
    – A.B
    Commented Dec 18, 2019 at 17:00
  • I'd be interest in something as suggestedby @mvorisek, too - any updates?
    – xeruf
    Commented Mar 20, 2022 at 16:17
  • @xeruf workaround in this answer of mine (to mvorisek) there: serverfault.com/questions/996037/nftables-timestamp-map
    – A.B
    Commented Mar 20, 2022 at 16:21
  • It seems this is now included in mainline and the nftables wifi has been updated to show the new options here: wiki.nftables.org/wiki-nftables/index.php/…
    – fileinsert
    Commented Jun 6, 2022 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .