Could I also please request a minimal example without persistence/save files? I'm still not certain on how to properly block all other IPs, and avoid the issue I have where, when the timeout elapses, everyone is locked out of the system.

@DevNull The save files only exist so you don't lose this when you reboot. If that doesn't matter to you, then ignore them.

That much I realize, but I don't see which piece of the example bans/blocks incoming IP connectivity outside of the whitelisted range (I edited the question to note this). Additionally, with the example I provided, it works, but after the timeout elapses, all incoming connections are blocked until I power cycle the machine. I was hoping I could block all incoming IPs outside of the whitelist. My intent is basically to allow a handful of IPs to have temporary, exclusive access to a machine (i.e. via SSH, TELNET, HTTP, etc.) and then guaranantee the change expires/times-out.

sudo iptables -A INPUT -m set ! --match-set temp_hosts src -j DROP This kills all your traffic when the whitelist is empty. You need to added entries with a timeout 0 for IP's that have permanent access.

I edited the question to address this (hopefully). Does the edited example match your suggestion?

Thank you for the help.

@DevNull As long as the conntrack entries are present existing connections will be allowed to continue after 3600 seconds, but not establish any new connections.

Does that apply to whitelisted and non-whitelisted connections?

i.e. if an IP is not in the whitelist, and the script is run, will that IP stay connected, or get kicked immediately?

The general goal is to never limit/interfere with whitelisted IPs.

and to ensure non-whitelisted IPs are kicked (even if already connected) and cannot establish new connections during the 3600 second duration/window.

Hi there.

thank you for taking the time to help with this, by the way.

the difficulty is your whitelist will be empty after 3600 seconds

you can do sudo iptables -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT --match-set whitelist src

this would allow whitelisted IP to continue communicating

you want resume normally activities and it actually cuts them off

Correct.

Ideally, after the timeout occurs, all rules added by my script are purged.

so first we need to replace hash:ip with hash:nets

sudo ipset create whitelist hash:net,port timeout 3600

OK.

otherwise ipset converts subnets into inidividual IP and your list has hundreds of entries

After 3600 seconds you might be better off running a script that deletes the last rule. iptables -D INPUT -m set ! --match-set whitelist src -j DROP

You could put that part in a cronjob

that would allow normal activity to be resumed

so your script would add that rule, and then create a cronjob to delete it after 3600 seconds

To confirm: go with the existing solution you provided, and use a cronjob to cleanup after?

via ` iptables -D INPUT -m set ! --match-set whitelist src -j DROP` ?

I thin your also going to have to add sudo iptables -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and sudo iptables -I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT to the cleanup script, and delete them when your script first executes

sudo iptables -D INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

sudo iptables -D FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

sudo iptables -D FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

because the conntrack would allow existing traffic to continue even after the temporary block occured

I'll try this out.

Thank you.

its late, I am going to have to sleep on it, and revisit this tomorrow

I managed to get this working flawlessly on Ubuntu 14.04 and 16.04.

For some reason, it doesn't work on CentOS 7.6

The "block all other users" piece doesn't seem to function.