Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to make my mySQL-server (running on Ubuntu) listen on port 3306 and 110, because I would like to access it from a network with very few open ports.

So far I've found this answer telling me to do

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 110 -j REDIRECT --to-port 3306

but all I got is:

# mysql -h mydomain.com -P 3306 -u username --password=xyz
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 68863
Server version: 5.0.75-0ubuntu10.5 (Ubuntu)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> exit
Bye

# mysql -h mydomain.com -P 110 -u username --password=xyz
ERROR 2003 (HY000): Can't connect to MySQL server on 'mydomain.com' (111)

I'm not an expert with iptables, so I not sure where to look for the problem. I'm googling around for quite some time, but haven't found anything to help me yet.

This is what iptable tells me:

# iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 32M packets, 1674M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REDIRECT   tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:110 redir ports 3306 

Chain POSTROUTING (policy ACCEPT 855K packets, 55M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 837K packets, 54M bytes)
 pkts bytes target     prot opt in     out     source               destination   


# iptables -L -n -v
Chain INPUT (policy DROP 7 packets, 340 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 107K 5390K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID limit: avg 2/sec burst 5 LOG flags 0 level 4 prefix `INPUT INVALID ' 
 131K 6614K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
    0     0 MY_DROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x00 
    0     0 MY_DROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x03/0x03 
    0     0 MY_DROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x06 
    0     0 MY_DROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x05/0x05 
    0     0 MY_DROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x11/0x01 
    0     0 MY_DROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x18/0x08 
    0     0 MY_DROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x30/0x20 
6948K   12G ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
 151M   34G ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
  32M 1666M ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80 
 1833  106K ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:443 
  603 29392 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:25 
    1    60 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:465 
   24  1180 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:110 
    1    60 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:995 
 7919  400K ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:143 
    1    60 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:993 
    0     0 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:119 
    1    60 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:53 
    7   517 ACCEPT     udp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:53 
 1110 65364 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:21 
 139K 8313K ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
10176  499K ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:3306 
    2    80 ACCEPT     udp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:123 
    0     0 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:6060 
    4   176 ACCEPT     tcp  --  venet0 *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:6667 
20987 1179K MY_REJECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2159  284K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID limit: avg 2/sec burst 5 LOG flags 0 level 4 prefix `OUTPUT INVALID ' 
 2630  304K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
6948K   12G ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
 181M   34G ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW,RELATED,ESTABLISHED 
    0     0 MY_REJECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain MY_DROP (7 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 2/sec burst 5 LOG flags 0 level 4 prefix `PORTSCAN DROP ' 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain MY_REJECT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
13806  652K LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 2/sec burst 5 LOG flags 0 level 4 prefix `REJECT TCP ' 
18171  830K REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with tcp-reset 
  912  242K LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 2/sec burst 5 LOG flags 0 level 4 prefix `REJECT UDP ' 
  912  242K REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 
 1904  107K LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 2/sec burst 5 LOG flags 0 level 4 prefix `DROP ICMP ' 
 1904  107K DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 2/sec burst 5 LOG flags 0 level 4 prefix `REJECT OTHER ' 
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-proto-unreachable

Is there anyone who can give ma a hint where to look for the problem?

Thank you!

share|improve this question
    
Can you also post the output of iptables -L -n -v? It's possible that mydomain.com's firewall is blocking inbound connections to 110. –  MadHatter Dec 27 '10 at 20:20
    
Yes, of course. I edited my post. –  marekventur Dec 27 '10 at 20:43

1 Answer 1

up vote 2 down vote accepted

The server mydomain.com only accepts inbound TCP connections on port 110 when they come in interface venet0. Since your iptables NAT rule applies only to traffic coming in interface eth0, either:

  • the traffic is coming in on interface venet0, and you've picked the wrong interface for the NAT rule, or
  • the traffic is coming in on interface eth0, and therefore never getting as far as the NAT rule because iptables is blocking it.

If you can tell us more about the interface setup on mydomain.com (ifconfig -a, perhaps) it should be possible to say which of these is true.

share|improve this answer
    
That sounds right. I found out that venet0 is the right interface so I tried "iptables -t nat -A PREROUTING -i venet0 -p tcp --dport 110 -j REDIRECT --to-port 3306" but I still can't connect... –  marekventur Dec 27 '10 at 21:05
1  
Or remove the interface limitation altogether: iptables -t nat -A PREROUTING -p tcp --dport 110 -j REDIRECT --to-port 3306 –  Mark Wagner Dec 27 '10 at 21:08
    
Sadly, still the same... –  marekventur Dec 27 '10 at 21:35
    
Oh, my fault. Everything is working fine. Thanks! –  marekventur Dec 27 '10 at 21:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.