Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a client running a mysql server with bind-address=0.0.0.0.

Here is the iptables output

root@host:/var/www# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             127.0.0.0/8         reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             mysql               tcp dpt:mysql
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: '
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

One web server can connect to the mysql server but another server cannot. They are both connecting on the same ip address, using the same username and password. It seems there is another firewall configured that is blocking this request. I'm not sure what else to check.

mysql -h <host> -u <user> -p<password>
ERROR 2003 (HY000): Can't connect to MySQL server on '<host>' (110)

Any ideas to point me in the right direction?

Update

It turns out the new web server was setup in a different data center than the mysql server so the internal network ip's couldn't communicate.

share|improve this question
    
Are the two webservers using the same connection string? It could be a DNS problem. –  Laurentiu Roescu Nov 20 '13 at 7:43
add comment

2 Answers

I think your problem is in second line of your iptables:

REJECT     all  --  anywhere             127.0.0.0/8         reject-with icmp-port-unreachable

it should be at the end

share|improve this answer
    
Have you tried to connect with telnet? –  Maxat Kulmanov Nov 20 '13 at 6:43
    
I cannot connect with telnet. I can't even ping the server since trying this rackspace article. I also tried removing the above line and reloading the ip tables. It didn't help. –  Rob Nov 20 '13 at 14:32
    
By the way, that firewall rule only drops traffic for 127/8 that's not on lo0. I am trying to connect to mysql on eth1 on a different ip address. –  Rob Nov 20 '13 at 14:37
    
why is your rule for allowing mysql has destination mysql? Could you post iptables -L -v output? –  Maxat Kulmanov Nov 21 '13 at 6:18
add comment

Had this the other day. Was caused by restoring a database, when I restored my mysql database (containing my users)

Had to manually create users to solve my issue.

Does your mysql server user have permission to accept connections from the remote server.

create user 'db_user'@'ip.address.of.remote.server' identified by 'password';
GRANT ALL PRIVILEGES ON test.* to 'db_user'@'localhost' identified by 'password'; 

for example if your clients ip address is 11.22.33.44

on your mysql server create a test database

create database test;

Now Create a test user

create user 'db_user'@'11.22.33.44' identified by 'password';

Now grant permissions

GRANT ALL PRIVILEGES ON test.* to 'db_user'@'11.22.33.44' identified by 'password';

After you have tested please delete the test database and test user

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.