I am trying a little bit of security by obscurity here and I want to do the following for a number of services (i.e. MySQL):
- Let the services definitely run on localhost on their default port
- Block remote access to the default port on public interfaces
- Allow remote access to the services through an alternative port (i.e. 53306 for MySQL) for the sake of some customers
I've tried using iptables and REDIRECT or DNAT through a number of combinations to no avail, and using SSH tunnels is too technical for the customers to do.
Any help would be appreciated!