0

I cannot connect to mysql from a remote server. I have bind-address commented out but when I add rules in iptables to block other connections the requesting server's connection times out.

I tried this suggestion:

iptables -I INPUT 1 -p tcp -s 1.2.3.4 --dport 3306 -j ACCEPT
iptables -I INPUT 1 -p tcp --dport 3306 -j DROP

But my connection still times out. It doesn't matter which order I enter these two lines. I am echoing the remote server ip address when I attempt to connect and it is indeed the ip address I am using in my iptables. Without the DROP line, the connection works fine, as it does when nothing is in my iptables.

The print out of echo -e "target prot opt source destination\n$(iptables -L INPUT -n | grep 3306)":

target     prot opt source               destination
ACCEPT     tcp  --  1.2.3.4              0.0.0.0/0           tcp dpt:3306 
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306

(above I have replaced the actual ip with 1.2.3.4)

Attempting a connection from another server (VPS) was successful. Which leads me to believe there is an issue with the shared server I am attempting to request from.

0

2 Answers 2

3

The issue is the rule order.

Entering the commands in that order will end up like this:

  1. If port 3306 DROP
  2. If port 3306 and Source IP is 1.2.3.4 ACCEPT

The issue is you drop the connection for before checking the Source IP. This is because the commands you entered prepend and not append the rules, thus the last command entered becomes the first rule.

You can solve this by:

  • Changing the -I to a -A (append) + Clear OLD Chains / Rules
  • OR reverse the order you type the commands.
1
0

After flushing iptables, I used iptraf to display a real time list of connections to port 3306.

The requesting server was a shared hosting server, and the IP address associated with the request differed from the IP address of the web application initiating the request. It was different AND changing.

The only solution was to move the application to a VPS which does not use a forward proxy or to the server which contained the database.

Special thanks to @Jnrprimo for looking at this with me.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .