How to Set Up Scheduled Downtime for Clients on a Linux Router

You can configure scheduled downtime for clients on a Linux router by leveraging the Netfilter framework, specifically using iptables or nftables to drop traffic based on time-based criteria. This approach allows you to enforce network access restrictions during specific hours without relying on third-party software, ensuring that designated devices are effectively disconnected from the internet at predefined times.

Understanding the Time-Based Mechanism

The core of this solution relies on the time module available in both iptables and its successor, nftables. These modules allow firewall rules to be evaluated not just against packet headers like source IP or destination port, but also against the current system time. By combining a match on the client's IP address with a time constraint, you can create precise windows where traffic is permitted or blocked. When configuring these rules, it is crucial to ensure that your router’s system clock is accurate. NTP (Network Time Protocol) should be running and synchronized to avoid discrepancies between the rule's intended execution time and the actual system time. If the clock drifts, scheduled downtime may occur at incorrect intervals, leading to either unintended connectivity or prolonged disconnection periods.

Configuring Downtime with Iptables

For systems still using the legacy iptables interface, the process involves adding rules to the FORWARD chain, assuming your router is forwarding traffic between the LAN and WAN interfaces. You will need to identify the specific IP addresses assigned to the clients you wish to restrict. It is highly recommended to use static DHCP reservations or manual static IPs for these devices to prevent their addresses from changing, which would break the firewall rules. To block all outgoing and incoming traffic for a specific client during a set window, you can use the following command structure. Replace 192.168.1.100 with the target client's IP, and adjust the start and end times as needed.

iptables -A FORWARD -s 192.168.1.100 -m time --timestart 22:00 --timestop 07:00 --weekdays Mon,Tue,Wed,Thu,Fri -j DROP
iptables -A FORWARD -d 192.168.1.100 -m time --timestart 22:00 --timestop 07:00 --weekdays Mon,Tue,Wed,Thu,Fri -j DROP

The first rule drops packets originating from the client, while the second drops packets destined for it. The --weekdays parameter ensures this applies only to weekdays, excluding weekends if desired. Remember that iptables rules are processed in order, so place these blocking rules before any general accept rules that might otherwise allow the traffic through.

Modern Approach with Nftables

If your Linux distribution uses nftables, which is becoming the standard in modern kernels, the syntax is more structured and efficient. Nftables uses sets and maps to manage rules more cleanly than the flat list of iptables commands. You would define a set containing the client IPs and then apply a time condition within a rule that references this set. Here is an example configuration snippet for nftables.conf:

table inet filter {
    set client_ips {
        type ipv4_addr
        elements = { 192.168.1.100 }
    }

    chain forward {
        type filter hook forward priority 0; policy accept;
        
        # Allow established connections
        ct state established,related accept
        
        # Block specified clients during downtime
        ip saddr @client_ips time weekday "Mon,Tue,Wed,Thu,Fri" hour "22:00-07:00" drop
        ip daddr @client_ips time weekday "Mon,Tue,Wed,Thu,Fri" hour "22:00-07:00" drop
    }
}

This method is often preferred for complex schedules because it separates data (the IP set) from logic (the rule), making updates easier. After editing the configuration file, reload the rules using nft -f /etc/nftables.conf or restart the service depending on your distribution.

Persistence and Maintenance

Firewall rules added via command line are typically lost upon reboot unless saved. For iptables, use tools like iptables-save and iptables-restore integrated into your system's startup scripts. For nftables, ensure the service is enabled to load the configuration file automatically at boot. Regularly review your rules to ensure they align with current network policies. As noted in related troubleshooting guides, such as Why is my public IPv6 address different from the one listed in Linux?, network configurations can shift unexpectedly. While IPv4 is commonly used for these simple MAC/IP bindings, consider whether your environment requires IPv6 support, which may necessitate additional rules in the ip6tables or nftables IPv6 tables. Additionally, if you encounter issues where devices remain reachable despite these rules, check for bridged NIC problems as described in Troubleshooting Unreachable Bridged NIC on Linux, since bridging can sometimes bypass standard routing table checks if not configured correctly.

Frequently Asked Questions

Does this method block local network access?

No, these rules typically apply to the FORWARD chain, which handles traffic leaving the local subnet. Devices on the same LAN can usually still communicate with each other. To block local access as well, you would need to add similar rules to the INPUT and OUTPUT chains for the specific interfaces.

What happens if the router reboots during downtime?

If your firewall rules are persisted correctly via iptables-save or nftables configuration files, the restrictions will remain active immediately after reboot. However, if the system clock has not synchronized via NTP yet, the time-based conditions might evaluate incorrectly until the clock is accurate.

Can I schedule different times for different clients?

Yes, you can create separate rules for each client IP with unique time parameters. In nftables, you can even use named sets for different groups of devices to streamline management. Each rule operates independently based on the source or destination IP address matched.

Is it safe to expose ports while doing this?

Scheduled downtime focuses on filtering traffic based on time, not on opening or closing ports dynamically. Exposing ports via tools like netcat carries its own risks unrelated to time scheduling. Always ensure that any open ports are secured with authentication and firewalled appropriately regardless of the downtime schedule.

How do I verify if the rules are working?

You can test by attempting to ping the client device or accessing a website from it during the scheduled window. Simultaneously, check the firewall log counters using iptables -L -v -n or nft list ruleset to see if packets are being dropped. Increased drop counts confirm the rules are active.