1

For some reason mysql connections from a specific IP address aren't allowed. This is the rule I have (grabbed from iptables-save):

-A INPUT -s 12.34.56.78/32 -p tcp -m state --state NEW -m multiport --dports 22,80,3306 -j ACCEPT

What's interesting here is that SSH connections and HTTP pages load perfectly without issue. I added 3306 for MySQL connections later, but they seem to be ignored. Why?

I'm on CentOS. I have restarted iptables service and have the IPTABLES_SAVE_ON_STOP/RESTART set to yes.

Running netstat -tunelp shows me this:

tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      27         8849593    10712/mysqld

Here is my full list of rules from iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  192.168.1.0/24       anywhere            state NEW multiport dports ssh,http,mysql
ACCEPT     tcp  --  some-resolved-hostname-1.com  anywhere            state NEW multiport dports ssh,http,mysql
ACCEPT     tcp  --  some-resolved-hostname-2.com  anywhere            state NEW multiport dports ssh,http,mysql
ACCEPT     tcp  --  some-resolved-hostname-3.com  anywhere            state NEW multiport dports ssh,http,mysql
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Note: There are no logs (including errors logs) on the server side. The error I get when trying to connect is:

D:\>mysql -u username -p -h 12.34.56.78
Enter password:
ERROR 2003 (HY000): Can't connect to MySQL server on '12.34.56.78' (10060)

Additionally (as this was from a Windows machine trying to connect) I tried this:

D:\>telnet 12.34.56.78 3306
Connecting To 12.34.56.78...Could not open connection to the host, on port 3306: Connect failed

Also note that skip_networking is to to off.

9
  • Can you post all your rules?
    – zhenech
    Aug 3, 2014 at 13:39
  • 2
    Check with nestat -tunelp that MySQL isn't listening on 127.0.0.1 only, as it's the standard configuration (while SSH and Apache listen on all interfaces by default). Aug 3, 2014 at 13:51
  • @zhenech I have listed all the rules @MrShunz I think it's running on all IPs - I have added the line of output from netstat Aug 3, 2014 at 14:39
  • What is the exact error messages tou get when trying to connect ? Are there any relevany messages in your logs ?
    – user9517
    Aug 3, 2014 at 15:15
  • try using netcat to verify whether you can open a tcp connection to the port. first connect locally nc -v localhost 3306 Connection to localhost 3306 port [tcp/vs-server] succeeded! and then try it remotely, just to verify that iptables is rejecting it. Aug 3, 2014 at 17:10

2 Answers 2

5

First, have you changed my.cnf to configure MySQL to listen for connections on the server's IP address? Your file should contain this line:

bind-address = <public_ip_address_of_your_machine>

Second, have you given permission to the user connecting from that IP address to connect, in MySQL?

GRANT ALL ON example.* TO someuser@'12.34.56.78' IDENTIFIED BY 'PASSWORD';

That would solve the issue if you are getting an error message similar to "Access denied for user: '[email protected]' (Using password: YES)"

Last, make sure that your router has port-forwarding and firewall rules allowing incoming connections to the MySQL server.

3
  • As you can see, it's bound to 0.0.0.0, which accepts TCP/IP connections on all server host IPv4 interfaces dev.mysql.com/doc/refman/5.5/en/… As for the user, that is setup, however it's a timeout, not an actual MySQL error. Aug 3, 2014 at 17:41
  • Is there another firewall or router connecting that machine to the Internet?
    – Bert
    Aug 3, 2014 at 17:47
  • Yes! Router. Man alive I should have thought of that. Just had to setup port forwarding for the port on the router. Would you mind appending your answer, so I can mark it as correct, seeing as you triggered the thought process to make the fix please? :) Aug 3, 2014 at 18:19
-1

I see --dports instead of --dport, maybe 22 and 80 works because they're allowed on another rule and it just can't apply this line?

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .