Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have my app (WordPress) and database (MySQL) on separate servers; they are connected on a private network provided by the hosting service provider, and I've taken all the preliminary steps (that I know of) for security.

Normally, I go with these IPTables rules:

*filter

#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#  Allow SSH connections
#
#  The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT

But for my standalone (MySQL) database server, I see that the rules need some changes. For example, I need to open port 3306 for MySQL, which would be as simple as:

-A INPUT -p tcp --dport 443 -j ACCEPT

Except, I don't know how to modify it so that only the app server is able to connect to the database (i.e. so that it supports a remote connection). So, how do I do it?

share|improve this question
    
I would uncomment the allow PING line, that's usually a good idea for troubleshooting/monitoring. Also, you'll need a 3306 rule for mysql. You can limit it to the source IP of your wordpress HTTP server. –  dmourati Sep 13 '13 at 16:18
    
@dmourati Hmm, thanks... I added -A INPUT -p tcp --dport 3306 -j ACCEPT, but I am not sure how to modify it to restrict access only to app server's IP address. –  its_me Sep 13 '13 at 16:22
    
You seem to have skipped the planning phase: Determine what traffic the server needs to allow. After that, it's easy to define the rules. Here you are only taking shots in the dark. –  Michael Hampton Sep 13 '13 at 16:24
    
@MichaelHampton I probably wasn't clear in the question, and I am not sure what details to add. It's clear to me that the database server should be accessible only to the app server and only via the IP addresses on the private network. But I am not sure how to turn it into IPTables rules, as I am new to it. –  its_me Sep 13 '13 at 16:37

1 Answer 1

up vote 1 down vote accepted

So you need

 -A INPUT -p tcp -s $INTERNAL_WEB_SERVER_IP --dport 3306 -j ACCEPT

Allows only your web server to talk to mysql. As dmourati mentions, allowing ping traffic is a good idea. IMHO it helps solve a lot more problems than security issues it presents.

iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d $SERVER_IP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -s $SERVER_IP -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT

The outbound rule you mentioned means that your db server can make any outgoing connections it's told to. Essentially ANY and ALL traffic originating from your database server will be allowed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.