LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 12-03-2016, 11:29 PM   #1
fabioca
LQ Newbie
 
Registered: Sep 2015
Posts: 13

Rep: Reputation: Disabled
Help with iptables kerneltz: how to set kernel time zone?


My goal is to set some iptables time zone rules based on local time, which, although it seems to me an obvious use case for time based rules, it seems not so easy to implement.

Iptables extension manual explains the issues with using the option kerneltz, which refers to "kernel time zone", and warns that many distribution will fail to set it or maintain it properly. In fact, in my case, using it seems not to make any difference as not using it, i.e. my filter rules always act with respect to UTC.

I run Linux Arch and I have full control of my system (i.e. I can run any custom made init or cron script I want), but I do not understand how to set properly this "kernel time zone", so that my iptables rules may work correctly.

I read the hwclock user guide and found an option --systz which might be what I need, but I feel I don't have a good understanding of the distinction about the various time existing on the system to use it safely.

If I understand correctly, there are 3 times:
- system time and time zone (manipulated via the date command)
- CMOS time (manipulated via the hwclock command)
- kernel time and timezone

1) How can I access and manipulate the kernel time and time zone?
2) I use ntp, to keep the system time up to date. What is the most recommended setup with respect to the other 2 times?

Last edited by fabioca; 12-04-2016 at 08:37 AM.
 
Old 12-05-2016, 11:06 AM   #2
tronayne
Senior Member
 
Registered: Oct 2003
Location: Northeastern Michigan, where Carhartt is a Designer Label
Distribution: Slackware 32- & 64-bit Stable
Posts: 3,541

Rep: Reputation: 1065Reputation: 1065Reputation: 1065Reputation: 1065Reputation: 1065Reputation: 1065Reputation: 1065Reputation: 1065
There are two clocks on your system, the hardware clock (run by the CMOS battery when the system is turned off) and the system clock (which is software run by kernel interrupts).

Typically, the system clock is set by the hardware clock at boot and, on system shutdown, the system clock time is written to the hardware clock.

Also typically, the system clock is kept synchronized by Network Time Protocol (NTP), a daemon that is started during boot (after the system clock is set). NTP synchronizes with either an external time server, referenced back to an so-called "atomic clock" or to a hardware clock on your LAN that uses GPS or radio clock signals (such as, in the US and Canada) WWV. If you're using NTP, you define three Internet pool time servers which NTP evaluates and determines the quality of the servers and chooses the best one (every so often NTP re-evaluates and may throw out one, two or all three pool servers and selects more from the available pool servers, evaluates the best of those and synchronizes to it.

The pool servers are defined in /etc/ntp.conf like this:
Code:
server 0.pool.ntp.org iburst
server 1.pool.ntp.org iburst
server 2.pool.ntp.org iburst
You do not want to specify one of the "atomic" clock servers, that's a no-no.

You also define a "fudge" server, actually you own system clock, to synchronize itself to when there is no Internet available (we had heavy wet snow last night, my satellite dish was covered with it, no signal until I went out and brushed it off and the Internet became available again -- NTP synchronized to the system clock and, when the 'Net came back, it synchronized with the external time serves).

A "fudge" server is defined like this:
Code:
server  127.127.1.0     # local clock
fudge   127.127.1.0 stratum 10
That permits the fall-back when there is no external synchronization available.

You can set your hardware clock to local time, you can also set it to UTC: you are encouraged to set the hardware clock to UTC and set your system clock to your local time zone. Software controls the switch to and from daylight savings time, summer time or whatever it's called where your system lives. The switch dates are known, they're in your system software and you don't have to fiddle with anything.

So, what's kernel time? It's system time, kept synchronized by NTP.

NTP does a great job of keeping everything on time and running smoothly.

So, for your purposes, simply use the time and date utilities (or system calls) to get the current time accurately (if you're using NTP, that is -- otherwise things wander all over the place). What NTP does is nudge your system time into accuracy by slowly (like over a week or two or three) adjusting the value stored in /etc/ntp/drif (that changes the longer NTP runs) to keep things pretty darned close (like a few milliseconds or so).

And, again, when you shut down the accurate system time is written to the hardware clock and when you boot, the system time is initially set from that and NTP takes over and synchronizes with an external time source and there you go.

Hope this helps some.
 
Old 11-28-2018, 02:55 AM   #3
descendant_command
Senior Member
 
Registered: Mar 2012
Posts: 1,876

Rep: Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643
This thread is a little old but was top of my search for the same issue as OP.

The system in question is Debian Buster ('testing' at time of post).
HW clock is set to UTC.
'date' command shows system time correctly as local (UTC +13).

The --kerneltz & --utc parameters to the iptables rule BOTH produce rules that fire at UTC time, rather than LOCAL, as would be expected for the first.

After issuing '/sbin/hwclock --hctosys' the --kerneltz parameter works as expected.

Digging a little further unearthed this bug report (https://bugs.debian.org/cgi-bin/bugr...cgi?bug=855203) showing some issues around correctly setting kernel time zone at boot time.

Without wading through that pile, I rather inelegantly "solved" my issue by adding an @reboot system cron entry to run /sbin/hwclock --hctosys
It may at some point become redundant, but it won't hurt in any case.
 
  


Reply

Tags
date, hwclock, iptables, timezone



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
what is the --kerneltz in iptables command. pradiptart Linux - Networking 5 05-22-2013 09:12 AM
From which version of iptables ,started supporting --kerneltz option. pradiptart Linux - Networking 1 05-15-2013 09:59 AM
Set Time Zone under xfce cccc Debian 2 03-17-2011 11:17 AM
Time skew of 580 min when I set my time zone in Gentoo scooter2 Linux - Newbie 1 03-05-2009 10:27 AM
Cannot set time/date to other time zone than UTC (Kubuntu) jamangold Ubuntu 1 12-23-2005 05:42 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 07:30 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration