Time-Based Access Control

Restrict tunnel access to specific days and times

Overview

Time-Based Access policies allow you to control when your tunnel can be accessed. Perfect for business hours restrictions, maintenance windows, and automated scheduling.

Key Features

• Allow or block during specific time windows
• Day of week selection (Monday-Sunday)
• Time range support (e.g., 9:00 AM - 5:00 PM)
• Timezone-aware (IANA timezones)
• Multiple time windows per policy

Configuration Schema

Field	Type	Description
mode	"allow" or "block" (optional, defaults to "allow")	"allow" = Whitelist mode: only allow requests during specified time windows "block" = Blacklist mode: block requests during specified time windows, allow all other times
timezone	String (optional, defaults to UTC)	IANA timezone identifier (e.g., "America/New_York", "Europe/London", "Asia/Tokyo"). All times are evaluated in this timezone.
time_windows	Array of objects (required)	List of time windows. Each window object has: `days` (optional): Array of day names (e.g., ["Monday", "Tuesday"] or ["Mon", "Tue"]). If omitted, applies to all days. `start_time` (optional): Start time in "HH:MM" format (24-hour, e.g., "09:00", "17:30") `end_time` (optional): End time in "HH:MM" format. Supports overnight windows (e.g., "22:00" to "06:00")

How It Works

• Allow mode: Only requests during the specified time windows are allowed. All other times are blocked.
• Block mode: Requests during the specified time windows are blocked. All other times are allowed.
• Time windows can span multiple days and support overnight ranges (e.g., 22:00 to 06:00)
• Day names can be full names ("Monday") or abbreviations ("Mon")
• If no time range is specified, the window applies to the entire day(s)

Configuration Examples

Example 1: Business Hours (9am-5pm Weekdays)

{
  "name": "Business Hours",
  "mode": "allow",
  "timezone": "America/New_York",
  "time_windows": [
    {
      "days": ["monday", "tuesday", "wednesday", "thursday", "friday"],
      "start_time": "09:00",
      "end_time": "17:00"
    }
  ]
}

Only accessible during office hours on weekdays.

Example 2: After Hours Access

{
  "name": "After Hours and Weekends",
  "mode": "allow",
  "timezone": "America/Los_Angeles",
  "time_windows": [
    {
      "days": ["monday", "tuesday", "wednesday", "thursday", "friday"],
      "start_time": "18:00",
      "end_time": "23:59"
    },
    {
      "days": ["saturday", "sunday"],
      "start_time": "00:00",
      "end_time": "23:59"
    }
  ]
}

Allow access after 6pm on weekdays and all day on weekends.

Example 3: Maintenance Window Block

{
  "name": "Block During Maintenance",
  "mode": "block",
  "timezone": "UTC",
  "time_windows": [
    {
      "days": ["sunday"],
      "start_time": "02:00",
      "end_time": "04:00"
    }
  ]
}

Block access during Sunday 2am-4am UTC maintenance window.

Example 4: 24/7 Except Weekends

{
  "name": "Weekday Access Only",
  "mode": "allow",
  "timezone": "Europe/London",
  "time_windows": [
    {
      "days": ["monday", "tuesday", "wednesday", "thursday", "friday"],
      "start_time": "00:00",
      "end_time": "23:59"
    }
  ]
}

Accessible anytime Monday-Friday, blocked on weekends.

Example 5: Lunch Break Block

{
  "name": "No Access During Lunch",
  "mode": "block",
  "timezone": "America/Chicago",
  "time_windows": [
    {
      "days": ["monday", "tuesday", "wednesday", "thursday", "friday"],
      "start_time": "12:00",
      "end_time": "13:00"
    }
  ]
}

Block access during lunch hour to save resources.

Common Timezones

Use IANA timezone identifiers:

North America

America/New_York (EST/EDT)
America/Chicago (CST/CDT)
America/Denver (MST/MDT)
America/Los_Angeles (PST/PDT)
America/Toronto

Europe

Europe/London (GMT/BST)
Europe/Paris (CET/CEST)
Europe/Berlin
Europe/Amsterdam
Europe/Moscow

Asia-Pacific

Asia/Tokyo (JST)
Asia/Shanghai (CST)
Asia/Singapore (SGT)
Australia/Sydney (AEDT)
Pacific/Auckland (NZDT)

Other

UTC (Universal)
America/Sao_Paulo
Asia/Dubai
Africa/Johannesburg

💡 Full List

See all timezones at IANA Time Zone Database

Common Use Cases

Business Hours Restriction

Only allow access during office hours to save resources and comply with policies.

Scheduled Demos

Make demo environments available only during presentation times.

Maintenance Windows

Block access during scheduled maintenance or deployment windows.

Cost Optimization

Reduce costs by blocking access when no one is using the tunnel.

Compliance Requirements

Meet security policies that restrict system access to business hours.

How to Use

Step 1: Create Policy

Go to Dashboard → Security → Time-Based Access

Click "Create Policy"
Choose allow or block mode
Select your timezone
Add time windows (days + time ranges)
Save the policy

Step 2: Apply to Tunnel

ngsrv http 3000 --policy ngsrv_time_ABC123

Step 3: Test Access

Try accessing during allowed times (should work)
Try during blocked times (should see 403 Forbidden)
Check audit logs for time-based blocks

Best Practices

✅ Use Correct Timezone

Make sure you use the timezone where users are located, not the server timezone.

✅ Plan for DST

IANA timezones automatically handle daylight saving time transitions.

⚠️ Avoid Overnight Ranges

For times crossing midnight, create two windows (before and after midnight).

💡 Combine with Notifications

Set up monitoring to alert when tunnels are blocked outside business hours.

Next Steps

→ Create time-based access policy → Combine with IP whitelisting → Add rate limiting → Monitor time-based blocks