Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have this iptable rule listing

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  127.0.0.1            0.0.0.0/0           tcp dpt:3306
acctboth   all  --  0.0.0.0/0            0.0.0.0/0
VZ_INPUT   all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
ACCEPT     tcp  -- 94.101.25.40      0.0.0.0/0           state NEW tcp dpt:3306

Chain FORWARD (policy DROP)
target     prot opt source               destination
VZ_FORWARD  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy DROP)
target     prot opt source               destination
acctboth   all  --  0.0.0.0/0            0.0.0.0/0
VZ_OUTPUT  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  94.101.25.40      0.0.0.0/0           state NEW tcp dpt:3306

I want only localhost and my ip to access tcp 3306. Can i deleted all other rules as shown above. I don't know if i nned to keep any of them or not

share|improve this question
add comment

1 Answer

The acctboth target is probably put there automatically by bandmin. If you delete it, it'll probably come back. You can disable bandmin with 'chkconfig bandmin off', but it really doesn't do anything other than count packets.

VZ_INPUT looks like a firewall package I'm not familiar with.

Apart from that, you seem to have three entries that accept all traffic for port 3306, and one that only allows new connections from what I assume is your ip.

I suggest you remove those last 4 rules on INPUT and replace them thusly:

iptables -A INPUT -p tcp --dport 3306 -s 94.101.25.40 -j ACCEPT
iptables -A INPUT -p tcp -i l0 --dport 3306 -j ACCEPT

Having an OUTPUT policy of DROP is a bit tricky, and may mess up a bunch of stuff, so if I were you I'd change it to ACCEPT:

iptables -p OUTPUT ACCEPT

If you insist on keeping what you have the way it is, you are only letting new SQL connections out, so delete the rule and add:

iptables -A OUTPUT -p tcp -s 94.101.25.40 --sport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -i l0 -sport 3306 -j ACCEPT

This assumes that 94.101.25.40 is one of the machine's own IP addresses, not some remote ip.

How are you accessing your server? Unless one of your other chains has it, I don't even see a rule to allow SSH traffic in here. You should really post your full iptables -L output. The chances are that the only reason you can still access your box are because of the rules in those other chains.

If you post again, please use iptables -L -v. This adds some useful extra information, like which interface the rule operates on.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.