Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to add a forward to the mysql server at to allow the access from, and Im using the following rules (its my whole iptables of the VPS of my hosting). I can connect locally at the server that holds the mysql service as localhost, but not from outside.

Can someone check if the following rules are fine? Thank you

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s --dport 3306 -j ACCEPT
-A INPUT -p tcp -s --sport 1024:65535 -d localhost --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -s localhost --sport 3306 -d --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

And this is the output of the connection trial.

[root@qwhosti /home/qwhosti/public_html/admin/config] # mysql -u user_db -p -h Enter password: ERROR 2003 (HY000): Can't connect to MySQL server on '' (113)

share|improve this question
This would be a lot easier to read, had you left out the irrelevant (for this question) rules. – 0xC0000022L Mar 8 '11 at 14:37
up vote 2 down vote accepted

Add your new rule on the RH-Firewall-1-INPUT chain BEFORE the -j REJECT rule. Rules are read from top to bottom, first one that matches gets applied; since there is no specifier on the REJECT rule, your incoming connections get REJECTed before they can be forwarded.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.