Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this iptable rule listing

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --             tcp dpt:3306
acctboth   all  --  
VZ_INPUT   all  --  
ACCEPT     tcp  --             tcp dpt:3306
ACCEPT     tcp  --             tcp dpt:3306
ACCEPT     tcp  --             tcp dpt:3306
ACCEPT     tcp  --           state NEW tcp dpt:3306

Chain FORWARD (policy DROP)
target     prot opt source               destination
VZ_FORWARD  all  --  

Chain OUTPUT (policy DROP)
target     prot opt source               destination
acctboth   all  --  
VZ_OUTPUT  all  --  
ACCEPT     tcp  --           state NEW tcp dpt:3306

I want only localhost and my ip to access tcp 3306. Can i deleted all other rules as shown above. I don't know if i nned to keep any of them or not

share|improve this question

The acctboth target is probably put there automatically by bandmin. If you delete it, it'll probably come back. You can disable bandmin with 'chkconfig bandmin off', but it really doesn't do anything other than count packets.

VZ_INPUT looks like a firewall package I'm not familiar with.

Apart from that, you seem to have three entries that accept all traffic for port 3306, and one that only allows new connections from what I assume is your ip.

I suggest you remove those last 4 rules on INPUT and replace them thusly:

iptables -A INPUT -p tcp --dport 3306 -s -j ACCEPT
iptables -A INPUT -p tcp -i l0 --dport 3306 -j ACCEPT

Having an OUTPUT policy of DROP is a bit tricky, and may mess up a bunch of stuff, so if I were you I'd change it to ACCEPT:

iptables -p OUTPUT ACCEPT

If you insist on keeping what you have the way it is, you are only letting new SQL connections out, so delete the rule and add:

iptables -A OUTPUT -p tcp -s --sport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -i l0 -sport 3306 -j ACCEPT

This assumes that is one of the machine's own IP addresses, not some remote ip.

How are you accessing your server? Unless one of your other chains has it, I don't even see a rule to allow SSH traffic in here. You should really post your full iptables -L output. The chances are that the only reason you can still access your box are because of the rules in those other chains.

If you post again, please use iptables -L -v. This adds some useful extra information, like which interface the rule operates on.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.