3

My config: ubuntu server 9 and msyql 5

my.cnf = bind-address = 0.0.0.0

my iptables script =

iptables -A INPUT -i eth0 -s 99.88.77.66 -p tcp --destination-port 3306 -j ACCEPT

I can connect from any place to mysql, not only that IP. I made a iptables-save , /etc/init.d/netwokring restart... but I still can connect from any IP, any clue ?

1
  • Perhaps you have a rule which is passing the packet from earlier in your ruleset. Can you post iptables -L?
    – gm3dmo
    Jan 22, 2010 at 16:01

3 Answers 3

3

This rule allows connections from 99.88.77.66, it does not prevent connections from somewhere else. To do that, you should have a rule that defaults to DROP for all incoming connections

iptables -P INPUT DROP

and then proceeds to allow only those you explicitly want to. Alternatively, you can close port 3306 specifically for all clients that are not 99.88.77.66

iptables -A INPUT -i eth0 -s ! 99.88.77.66 -p tcp --destination-port 3306 -j DROP
2

That rule allows traffic from a particular IP to port 3306/tcp. You need later rule (or default policy) to drop all other traffic to that port, because the default iptables policy is to allow everything.

1
  • 1
    Specifically: iptables -A INPUT -i eth0 -s ! 99.88.77.66 -p tcp --destination-port 3306 -j DROP
    – MikeyB
    Jan 22, 2010 at 20:57
0

perhaps your default policy of iptables is allow for all input traffic. this would allow a connection from any ip. change this policy to drop:

iptables -P INPUT DROP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .