Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For some reason mysql connections from a specific IP address aren't allowed. This is the rule I have (grabbed from iptables-save):

-A INPUT -s -p tcp -m state --state NEW -m multiport --dports 22,80,3306 -j ACCEPT

What's interesting here is that SSH connections and HTTP pages load perfectly without issue. I added 3306 for MySQL connections later, but they seem to be ignored. Why?

I'm on CentOS. I have restarted iptables service and have the IPTABLES_SAVE_ON_STOP/RESTART set to yes.

Running netstat -tunelp shows me this:

tcp        0      0      *                   LISTEN      27         8849593    10712/mysqld

Here is my full list of rules from iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --       anywhere            state NEW multiport dports ssh,http,mysql
ACCEPT     tcp  --  anywhere            state NEW multiport dports ssh,http,mysql
ACCEPT     tcp  --  anywhere            state NEW multiport dports ssh,http,mysql
ACCEPT     tcp  --  anywhere            state NEW multiport dports ssh,http,mysql
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Note: There are no logs (including errors logs) on the server side. The error I get when trying to connect is:

D:\>mysql -u username -p -h
Enter password:
ERROR 2003 (HY000): Can't connect to MySQL server on '' (10060)

Additionally (as this was from a Windows machine trying to connect) I tried this:

D:\>telnet 3306
Connecting To not open connection to the host, on port 3306: Connect failed

Also note that skip_networking is to to off.

share|improve this question
Can you post all your rules? – zhenech Aug 3 '14 at 13:39
Check with nestat -tunelp that MySQL isn't listening on only, as it's the standard configuration (while SSH and Apache listen on all interfaces by default). – Mr Shunz Aug 3 '14 at 13:51
@zhenech I have listed all the rules @MrShunz I think it's running on all IPs - I have added the line of output from netstat – Leonard Challis Aug 3 '14 at 14:39
What is the exact error messages tou get when trying to connect ? Are there any relevany messages in your logs ? – Iain Aug 3 '14 at 15:15
try using netcat to verify whether you can open a tcp connection to the port. first connect locally nc -v localhost 3306 Connection to localhost 3306 port [tcp/vs-server] succeeded! and then try it remotely, just to verify that iptables is rejecting it. – user3100381 Aug 3 '14 at 17:10
up vote 5 down vote accepted

First, have you changed my.cnf to configure MySQL to listen for connections on the server's IP address? Your file should contain this line:

bind-address = <public_ip_address_of_your_machine>

Second, have you given permission to the user connecting from that IP address to connect, in MySQL?


That would solve the issue if you are getting an error message similar to "Access denied for user: 'someuser@' (Using password: YES)"

Last, make sure that your router has port-forwarding and firewall rules allowing incoming connections to the MySQL server.

share|improve this answer
As you can see, it's bound to, which accepts TCP/IP connections on all server host IPv4 interfaces… As for the user, that is setup, however it's a timeout, not an actual MySQL error. – Leonard Challis Aug 3 '14 at 17:41
Is there another firewall or router connecting that machine to the Internet? – Bert Aug 3 '14 at 17:47
Yes! Router. Man alive I should have thought of that. Just had to setup port forwarding for the port on the router. Would you mind appending your answer, so I can mark it as correct, seeing as you triggered the thought process to make the fix please? :) – Leonard Challis Aug 3 '14 at 18:19

I see --dports instead of --dport, maybe 22 and 80 works because they're allowed on another rule and it just can't apply this line?

share|improve this answer
This is valid syntax, with the multiport module. See here:… – Leonard Challis Aug 3 '14 at 13:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.