Iptables blocking mysql port 3306

Question

I got a Tomcat server running a web application that must access a mysql server via Hibernate on the same machine.

So, I added a rule for port 3306 to my iptables script but tomcat cannot connect to the mysql server for some reason. I need to reset all iptables rules - Then tomcat can connect to the mysql server again.

All the other iptables rules work perfectly though.

What's wrong?

Here is my script:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp --dport 24 -j ACCEPT

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -p tcp -s localhost --dport 8009 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --dport 8009 -j ACCEPT

iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --dport 3306 -j ACCEPT

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

iptables -A INPUT -p tcp --dport 25 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

iptables -A INPUT -p tcp --dport 587 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT

iptables -A INPUT -p tcp --dport 465 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT

iptables -A INPUT -p tcp --dport 110 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 110 -j ACCEPT

iptables -A INPUT -p tcp --dport 995 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 995 -j ACCEPT

iptables -A INPUT -p tcp --dport 143 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 143 -j ACCEPT

iptables -A INPUT -p tcp --dport 993 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 993 -j ACCEPT

iptables -A INPUT -j DROP

My /etc/hosts file:

# nameserver config
# IPv4
127.0.0.1 localhost
46.4.7.93 mydomain.com
46.4.7.93 Ubuntu-1004-lucid-64-minimal
46.4.7.93 horst

# IPv6
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

Having a look into the iptables logs, gives me this:

Jun 22 16:52:43 Ubuntu-1004-lucid-64-minimal kernel: [  435.111780] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52432 DF PROTO=TCP SPT=56108 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:46 Ubuntu-1004-lucid-64-minimal kernel: [  438.110555] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52433 DF PROTO=TCP SPT=56108 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:46 Ubuntu-1004-lucid-64-minimal kernel: [  438.231954] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48020 DF PROTO=TCP SPT=56109 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:49 Ubuntu-1004-lucid-64-minimal kernel: [  441.229778] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48021 DF PROTO=TCP SPT=56109 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:53:57 Ubuntu-1004-lucid-64-minimal kernel: [  508.731839] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=78.92.97.67 DST=46.4.7.93 LEN=64 TOS=0x00 PREC=0x00 TTL=122 ID=23053 DF PROTO=TCP SPT=1672 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0 
Jun 22 16:53:59 Ubuntu-1004-lucid-64-minimal kernel: [  511.625038] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=78.92.97.67 DST=46.4.7.93 LEN=64 TOS=0x00 PREC=0x00 TTL=122 ID=23547 DF PROTO=TCP SPT=1672 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0 
Jun 22 16:54:22 Ubuntu-1004-lucid-64-minimal kernel: [  533.981995] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=27.254.39.16 DST=46.4.7.93 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=6549 PROTO=TCP SPT=6005 DPT=33796 WINDOW=64240 RES=0x00 ACK SYN URGP=0 
Jun 22 16:54:44 Ubuntu-1004-lucid-64-minimal kernel: [  556.297038] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=94.78.93.41 DST=46.4.7.93 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=7712 PROTO=TCP SPT=57598 DPT=445 WINDOW=512 RES=0x00 SYN URGP=0

Update: After adding additional log info (iptables -L INPUT -v -n and iptables -L OUTPUT -v -n), I get immediately after running the script:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:24 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0           tcp dpt:8009 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0           tcp dpt:3306 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:25 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:587 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:465 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:110 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:995 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:143 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:993 state ESTABLISHED 
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            127.0.0.1           tcp dpt:8009 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            127.0.0.1           tcp spt:3306 flags:!0x17/0x02 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:25 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:587 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:465 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:110 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:995 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:143 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:993

Syslog says:

Jun 22 23:59:16 Ubuntu-1004-lucid-64-minimal kernel: [  546.919862] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=20787 DF PROTO=TCP SPT=60809 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 23:59:19 Ubuntu-1004-lucid-64-minimal kernel: [  549.917002] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=20788 DF PROTO=TCP SPT=60809 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 23:59:19 Ubuntu-1004-lucid-64-minimal kernel: [  550.036103] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=7078 DF PROTO=TCP SPT=60810 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 23:59:22 Ubuntu-1004-lucid-64-minimal kernel: [  553.026132] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=7079 DF PROTO=TCP SPT=60810 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0

the-wabbit · Accepted Answer · 2011-06-22 14:36:38Z

5

This

iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --dport 3306 -j ACCEPT

should be

iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --sport 3306 ! --syn -j ACCEPT

instead. You want your answer packets to return as well - these will have tcp/3306 set as the source port.

BTW: for debugging purposes it would be a good idea to replace your last line dropping all traffic

iptables -A INPUT -j DROP

with something more intuitive like

iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "denied-input "
iptables -A INPUT -j REJECT

where you would find characteristics for dropped packets logged to syslog (at least to a certain extent - to prevent opening DoS attack vectors, logging is limited to 10 events per minute in this example) so you could look out for them.

edited Jun 22, 2011 at 14:36

answered Jun 22, 2011 at 14:28

the-wabbit

41k14 gold badges115 silver badges176 bronze badges

Hm, that didn't do that trick :-(
– Timo Ernst
Jun 22, 2011 at 14:43
See my original post for the log
– Timo Ernst
Jun 22, 2011 at 14:56
The log excerpt does not list any packets in the INPUT chain to port 3306 which have been blocked, just packets to port 8009 where the ruleset is broken in a similar way. I cannot see if you have posted your complete iptables script here - could you post the outputs of iptables -L INPUT -v -n and iptables -L OUTPUT -v -n as well? Thank you.
– the-wabbit
Jun 22, 2011 at 16:03
No, the script I posted is complete. You said the 8009 rule is broken? In what way? I also posted the results of the additional log output to my original post. Thanks for your help!
– Timo Ernst
Jun 22, 2011 at 21:58
That does not make any sense, your INPUT and OUTPUT chains do have ACCEPT as the default policy and do not contain a single rule rejecting or dropping packets. If you are still seeing "connection refused" then this will be due to mysql not listening to the given port at the localhost's address. netstat -anp | egrep LISTEN.*mysqld will help checking it.
– the-wabbit
Jun 22, 2011 at 23:32

| Show 4 more comments

Rilindo · Accepted Answer · 2011-06-22 23:50:08Z

0

First of all, can you connect to the port? Something like:

[rilindo@centos sysconfig]$ telnet 127.0.0.1 3306
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
4
5.0.77-3W@yaYx,sYD)?AhgN2LgConnection closed by foreign host.

Also, you may want to adjust your iptables so that it can match the TCP rule

iptables -A INPUT -p tcp -m tcp -s 127.0.0.1 --dport 3306 -j ACCEPT

(FWIW, I loaded the ruleset that is provided on my Ubuntu instance (10.4) and with that running, I can connect to mySQL).

answered Jun 22, 2011 at 23:50

Rilindo

5,0885 gold badges29 silver badges46 bronze badges

Hm, telnet 127.0.0.1 3306 works (gives me "connected to 127.0.0.1"). The fact that my iptable rules work for you (but not for me) makes starting me thing that something with the rules for port 8009 (tomcat) is wrong but I can't figure out what...
– Timo Ernst
Jun 23, 2011 at 0:09

Add a comment |

Stack Exchange Network

Iptables blocking mysql port 3306

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
mysql
iptables
tomcat
.

Hot Network Questions

Iptables blocking mysql port 3306

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged mysqliptablestomcat.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
mysql
iptables
tomcat
.