Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My config: ubuntu server 9 and msyql 5

my.cnf = bind-address =

my iptables script =

iptables -A INPUT -i eth0 -s -p tcp --destination-port 3306 -j ACCEPT

I can connect from any place to mysql, not only that IP. I made a iptables-save , /etc/init.d/netwokring restart... but I still can connect from any IP, any clue ?

share|improve this question
Perhaps you have a rule which is passing the packet from earlier in your ruleset. Can you post iptables -L? – davey Jan 22 '10 at 16:01
up vote 3 down vote accepted

This rule allows connections from, it does not prevent connections from somewhere else. To do that, you should have a rule that defaults to DROP for all incoming connections

iptables -P INPUT DROP

and then proceeds to allow only those you explicitly want to. Alternatively, you can close port 3306 specifically for all clients that are not

iptables -A INPUT -i eth0 -s ! -p tcp --destination-port 3306 -j DROP
share|improve this answer

That rule allows traffic from a particular IP to port 3306/tcp. You need later rule (or default policy) to drop all other traffic to that port, because the default iptables policy is to allow everything.

share|improve this answer
Specifically: iptables -A INPUT -i eth0 -s ! -p tcp --destination-port 3306 -j DROP – MikeyB Jan 22 '10 at 20:57

perhaps your default policy of iptables is allow for all input traffic. this would allow a connection from any ip. change this policy to drop:

iptables -P INPUT DROP
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.