Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My config: ubuntu server 9 and msyql 5

my.cnf = bind-address = 0.0.0.0

my iptables script =

iptables -A INPUT -i eth0 -s 99.88.77.66 -p tcp --destination-port 3306 -j ACCEPT

I can connect from any place to mysql, not only that IP. I made a iptables-save , /etc/init.d/netwokring restart... but I still can connect from any IP, any clue ?

share|improve this question
    
Perhaps you have a rule which is passing the packet from earlier in your ruleset. Can you post iptables -L? –  davey Jan 22 '10 at 16:01

3 Answers 3

up vote 3 down vote accepted

This rule allows connections from 99.88.77.66, it does not prevent connections from somewhere else. To do that, you should have a rule that defaults to DROP for all incoming connections

iptables -P INPUT DROP

and then proceeds to allow only those you explicitly want to. Alternatively, you can close port 3306 specifically for all clients that are not 99.88.77.66

iptables -A INPUT -i eth0 -s ! 99.88.77.66 -p tcp --destination-port 3306 -j DROP
share|improve this answer

perhaps your default policy of iptables is allow for all input traffic. this would allow a connection from any ip. change this policy to drop:

iptables -P INPUT DROP
share|improve this answer

That rule allows traffic from a particular IP to port 3306/tcp. You need later rule (or default policy) to drop all other traffic to that port, because the default iptables policy is to allow everything.

share|improve this answer
1  
Specifically: iptables -A INPUT -i eth0 -s ! 99.88.77.66 -p tcp --destination-port 3306 -j DROP –  MikeyB Jan 22 '10 at 20:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.