Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to rate limit connections on MySQL 3306 by using IPTABLES? I'm thinking to allow 2 connection attemps to port 3306 every 5 minutes. Thanks

share|improve this question
2  
I have to ask why you'd want to do this. –  David Pashley Oct 11 '09 at 19:28
    
we got some clients that run a desktop app that connects to mysql. we only want those desktop apps being able to connect and not dictionary attacks. –  Josh Darrow Oct 11 '09 at 23:15

4 Answers 4

Would it not be better to keep these restrictions within MySQL itself, rather than on the network level? According to the MySQL documentation you can limit the following server resources for individual accounts:

*  The number of queries that an account can issue per hour
*  The number of updates that an account can issue per hour
*  The number of times an account can connect to the server per hour
*  The number of simultaneous connections to the server an account can have

An example MySQL query to do this:

mysql> CREATE USER 'francis'@'localhost' IDENTIFIED BY 'frank';
mysql> GRANT ALL ON customer.* TO 'francis'@'localhost'
    ->     WITH MAX_QUERIES_PER_HOUR 20
    ->          MAX_UPDATES_PER_HOUR 10
    ->          MAX_CONNECTIONS_PER_HOUR 5
    ->          MAX_USER_CONNECTIONS 2;

I'd personally prefer to keep this type of setting within the application itself, rather than trying to manipulate it without the applications knowledge. But from what I understand the other examples of using iptables should technically work too.

share|improve this answer
$IPT -A INPUT -s 0/0 -p tcp --dport 3306 --syn -m limit --limit 10/hour \

--limit-burst 10 -j ACCEPT


$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


$IPT -A INPUT -s 0/0 -p tcp --dport 3306 -j DROP
share|improve this answer

I was interested enough to do a search, found this article amongst others. Looks like you can do it.

share|improve this answer

Note that, depending on the application, limiting the amount of connections might not actually limit the amount of queries. There's nothing stopping the app from making hundreds of queries on a single connection, it's even best practice to do so.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.