Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to setup a rule in iptables where I only allow remote connections if the user trying to login into MySQL is "someuser" and reject all other possible remote connections. Locally should allow any users.

Is this possible? if so what would be a good rule for this?

Any comments will be appreciate it.

share|improve this question
BTW, the remote machine constantly changes IP, so I can't just allow incoming connections from a specific IP. – Josh Darrow Oct 11 '09 at 6:54
Have the remote machine use something like, and use the MySQL GRANT syntax using the hostname. – Xorlev Oct 11 '09 at 18:22

Not possible at the packet level (which is where IPTables operates). However, MySQL will let you GRANT permissions to users connecting FROM a specific host.

share|improve this answer

Iptables doesn't know anything about remote users.

A couple good alternatives may include:

  • Require the user to build a SSH connection or some type of VPN to your network.
  • Use something like port knocking, to open access through the firewall only for the person able to send the knock.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.