Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to allow a host access to port 3306 by IP. I've added the rule and ran an iptables-save and also service iptables save. These commands show as "OK" with no reported errors. And this works absolutely fine.

Now, the server hasn't been restarted at all since I've been having this problem, but every day when I start developing on the server that needs mySQL access, it reports that the connection is refused. Back on the mySQL server, all I need to do is service iptables restart and everything then works as normal.

The mySQL server is a CentOS cPanel VPS running on OpenVZ.

Anyone know how I can make these rules persist? Is it something cPanel is doing overnight that is messing with my config? Thanks.

share|improve this question

3 Answers 3

up vote 0 down vote accepted

James, Make sure that your /etc/sysconfig/iptables file contains the rules you have configured; if they're not in there then you should add them, and this should resolve the issue.


share|improve this answer

I had the same problem with a client's CentOS 6.5 box with CPanel. Turned out there was a third-party firewall called CSF as part of CPanel which was conflicting with iptables. I just added my slave server's IP address to /etc/csf/csf.allow and it was then permitted to traverse the firewall.

If you type:

service iptables status

and then

service csf status

And you see the same output both times, then this is your problem. Each daemon is clearing and loading its own firewall rules into the kernel when it starts.

share|improve this answer
I imagine it took you an age to discover this, thanks for saving me debugging time! After an IPtables rule change and a reboot suddenly things were blocked again even though the rules were recovering. Sneaky CSF –  Rudu Sep 26 '14 at 15:04

Try add the following line to /etc/sysconfig/iptables file and restart the iptables.

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306-s YOUR_IP_ADD -j ACCEPT

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.