3

My config: ubuntu server 9 and msyql 5

my.cnf = bind-address = 0.0.0.0

my iptables script =

iptables -A INPUT -i eth0 -s 99.88.77.66 -p tcp --destination-port 3306 -j ACCEPT

I can connect from any place to mysql, not only that IP. I made a iptables-save , /etc/init.d/netwokring restart... but I still can connect from any IP, any clue ?

  • Perhaps you have a rule which is passing the packet from earlier in your ruleset. Can you post iptables -L? – davey Jan 22 '10 at 16:01
3

This rule allows connections from 99.88.77.66, it does not prevent connections from somewhere else. To do that, you should have a rule that defaults to DROP for all incoming connections

iptables -P INPUT DROP

and then proceeds to allow only those you explicitly want to. Alternatively, you can close port 3306 specifically for all clients that are not 99.88.77.66

iptables -A INPUT -i eth0 -s ! 99.88.77.66 -p tcp --destination-port 3306 -j DROP
2

That rule allows traffic from a particular IP to port 3306/tcp. You need later rule (or default policy) to drop all other traffic to that port, because the default iptables policy is to allow everything.

  • 1
    Specifically: iptables -A INPUT -i eth0 -s ! 99.88.77.66 -p tcp --destination-port 3306 -j DROP – MikeyB Jan 22 '10 at 20:57
0

perhaps your default policy of iptables is allow for all input traffic. this would allow a connection from any ip. change this policy to drop:

iptables -P INPUT DROP

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.