Time-based Access Control

Time-based access control in MikroTik RouterOS allows administrators to restrict user access to network resources based on specific time periods. This feature is particularly useful for managing access during business hours, after-hours, or for scheduled maintenance periods. This webpage will delve into the key concepts of time-based access control, providing detailed explanations and practical examples.

Key Concepts

1. Time Schedules

Time schedules define the specific periods during which access is allowed or denied. These schedules can be set to repeat daily, weekly, or on specific dates. Time schedules are the foundation of time-based access control, allowing administrators to create flexible and precise access rules.

Imagine a school where students have access to the library only during certain hours. Just as the library has specific opening and closing times, time schedules in MikroTik RouterOS define when users can access network resources.

2. User Profiles

User profiles in MikroTik RouterOS are collections of settings and permissions that can be applied to individual users or groups. Time-based access control can be integrated into user profiles, allowing administrators to enforce time restrictions for specific users or groups.

Consider a company where employees have different access levels based on their roles. Just as each employee has a specific job description, user profiles in MikroTik RouterOS can be tailored to include time-based access restrictions.

3. Access Lists

Access lists are rules that determine which users can access specific network resources. Time-based access control can be applied to access lists, allowing administrators to create rules that are active only during certain time periods. This ensures that access to critical resources is restricted outside of business hours.

Think of access lists as security checkpoints at an airport. Just as the checkpoints are active during specific hours, access lists in MikroTik RouterOS can be configured to enforce time-based restrictions.

Examples and Analogies

Example 1: Creating a Time Schedule

To create a time schedule that allows access from 9 AM to 5 PM on weekdays, you would use the following command:

        /system scheduler add name=WeekdayAccess on-event="/ip service set telnet disabled=no" start-time=09:00:00 stop-time=17:00:00 days=mon,tue,wed,thu,fri
    

In this example, the "WeekdayAccess" schedule enables access to the Telnet service during weekdays from 9 AM to 5 PM.

Example 2: Applying Time-based Access to User Profiles

To apply a time schedule to a user profile, you would configure the profile to use the schedule. For example, to create a user profile named "OfficeHours" that restricts access to the "WeekdayAccess" schedule, you would use the following command:

        /user profile add name=OfficeHours schedule=WeekdayAccess
    

In this example, the "OfficeHours" profile ensures that users assigned to this profile can only access the network during the specified weekday hours.

Example 3: Configuring Time-based Access Lists

To create an access list that restricts access to the internet from 5 PM to 9 AM on weekdays, you would use the following command:

        /ip firewall filter add chain=forward action=drop src-address=192.168.1.0/24 dst-address=0.0.0.0/0 time=WeekdayAccess
    

In this example, the access list drops all traffic from the specified source address to the internet during the specified time period, ensuring that users cannot access the internet outside of business hours.

By understanding and implementing time-based access control, administrators can create a more secure and efficient network environment. This approach allows for fine-grained control over user access, ensuring that network resources are only available during appropriate times.