0

I have a client running a mysql server with bind-address=0.0.0.0.

Here is the iptables output

root@host:/var/www# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             127.0.0.0/8         reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             mysql               tcp dpt:mysql
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: '
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

One web server can connect to the mysql server but another server cannot. They are both connecting on the same ip address, using the same username and password. It seems there is another firewall configured that is blocking this request. I'm not sure what else to check.

mysql -h <host> -u <user> -p<password>
ERROR 2003 (HY000): Can't connect to MySQL server on '<host>' (110)

Any ideas to point me in the right direction?

Update

It turns out the new web server was setup in a different data center than the mysql server so the internal network ip's couldn't communicate.

1
  • Are the two webservers using the same connection string? It could be a DNS problem. Nov 20, 2013 at 7:43

2 Answers 2

1

I think your problem is in second line of your iptables:

REJECT     all  --  anywhere             127.0.0.0/8         reject-with icmp-port-unreachable

it should be at the end

4
  • Have you tried to connect with telnet? Nov 20, 2013 at 6:43
  • I cannot connect with telnet. I can't even ping the server since trying this rackspace article. I also tried removing the above line and reloading the ip tables. It didn't help.
    – Rob
    Nov 20, 2013 at 14:32
  • By the way, that firewall rule only drops traffic for 127/8 that's not on lo0. I am trying to connect to mysql on eth1 on a different ip address.
    – Rob
    Nov 20, 2013 at 14:37
  • why is your rule for allowing mysql has destination mysql? Could you post iptables -L -v output? Nov 21, 2013 at 6:18
0

Had this the other day. Was caused by restoring a database, when I restored my mysql database (containing my users)

Had to manually create users to solve my issue.

Does your mysql server user have permission to accept connections from the remote server.

create user 'db_user'@'ip.address.of.remote.server' identified by 'password';
GRANT ALL PRIVILEGES ON test.* to 'db_user'@'localhost' identified by 'password'; 

for example if your clients ip address is 11.22.33.44

on your mysql server create a test database

create database test;

Now Create a test user

create user 'db_user'@'11.22.33.44' identified by 'password';

Now grant permissions

GRANT ALL PRIVILEGES ON test.* to 'db_user'@'11.22.33.44' identified by 'password';

After you have tested please delete the test database and test user

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .