Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

CentOS 5.4, with IP tables stopped, I can do it. What's the line I need to add to IPtables so I can keep it on and have remote (domain) access to the mysql databases?

my current table:

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.1/24 -m state --state NEW -m udp -p udp --dport 445 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
share|improve this question
add comment

4 Answers

up vote 3 down vote accepted

Just using "-A" adds the rule to the end of the chain, and as mark suggested, this will put the mysql ACCEPT after the blanket REJECT; no packet will ever get to it.

You can either edit the /etc/sysconfig/iptables file to add the line

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT

immediately after the line

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

and then restart the iptables service, or you could manually do it with

iptables -I RH-Firewall-1-INPUT 11 -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT

which will put it in the same place, but need to be done after each reboot.

share|improve this answer
    
You rock! It worked. I was a bit nervous when you said "but need to be done after each reboot," but I guessed you meant restart. Anyway, it worked after manual edit and service iptables restart. Thanks. –  Detritus Maximus Oct 16 '10 at 16:48
1  
To avoid having to add the rule after each reboot do sudo service iptables save. –  Iain Oct 16 '10 at 19:47
add comment

Try this:

iptables -A INPUT -p tcp --destination-port 3306 -j ACCEPT
share|improve this answer
    
for a specific address ip address: iptables -A INPUT -p tcp --dport 3306 -s IP_ADDRESS -j ACCEPT –  bindbn Oct 16 '10 at 16:17
    
@bindbn: it didn't work. I added my iptables to my original post if it helps. Hmmm, when I enter your command at the prompt and then look at the table, it does not appear to be adding/changing anything??? –  Detritus Maximus Oct 16 '10 at 16:34
    
The file you have included is /etc/sysconfig/iptables, which configures the firewall at boot (strictly, at iptables service start) time. It does not change as you add or delete rules from the running firewall. "iptables -L -n -v" will tell you the state of the current, running firewall. –  MadHatter Oct 16 '10 at 16:45
add comment

Try

iptables -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 3306 -j ACCEPT

This article also gives information on how to further restrict access to the mysql port.

share|improve this answer
add comment

Depending on how your firewall is set up currently, you will optionally need the outgoing one and you also may need to fiddle with the order of the rules so that these come before any blanket REJECT or DROP rules you might already have.

# for incoming
iptables -A INPUT -i eth0 -p tcp --dport 3306 -j ACCEPT
# for outgoing
iptables -A OUTPUT -i eth0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT
share|improve this answer
    
I edited my original post after seeing your answer. Does that change your response? –  Detritus Maximus Oct 16 '10 at 16:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.