0

we are running mysql replication between a server outside dmz and one inside dmz, for this we need port forwarding. We have had it set up, but it recently stopped working. Just before we added a rule (rule number 01500) that would allow traffic for nrpe (monitoring with naigos).

The set up consists of a legacy redhat 5 server that runs mysql (5.1.22-rc-community-log) that should receive data from a freebsd 8.0-RELEASE server (this is 192.168.10.10) running mysql (5.1.42-log) that is behind a gateway running freebsd 8.0-RELEASE-p2.

note that I will replace all public ips with a.b.c.d-style ips...

if I telnet from the gateway to 192.168.10.10:3306, it will connect to the mysql on the correct server. if I telnet to localhost:3306, 127.0.0.1:3306 or a.b.c.f:3306 it will refused the connection immediately. on a.b.c.e telnetting to a.b.c.f:3306 does the same thing.

I excepted it to allow the traffic because:

natd process looks like :

/sbin/natd -redirect_port tcp 192.168.10.10:3306 3306 -n bce0  

/etc/hosts.allow looks like :

ALL : ALL : allow

gateway firewall looks like :

00100 allow ip from any to any via lo0  
00200 deny ip from any to 127.0.0.0/8  
00300 deny ip from 127.0.0.0/8 to any  
00400 deny ip from 192.168.10.0/24 to any in via bce0  
00500 deny ip from a.b.c.d/26 to any in via bce1  
00600 deny ip from any to 10.0.0.0/8 via bce0  
00700 deny ip from any to 172.16.0.0/12 via bce0  
00800 deny ip from any to 192.168.0.0/16 via bce0  
00900 deny ip from any to 0.0.0.0/8 via bce0  
01000 deny ip from any to 169.254.0.0/16 via bce0  
01100 deny ip from any to 192.0.2.0/24 via bce0  
01200 deny ip from any to 224.0.0.0/4 via bce0  
01300 deny ip from any to 240.0.0.0/4 via bce0  
01400 allow tcp from a.b.c.e to me dst-port 3306  
01500 allow tcp from a.b.c.d/26 to me dst-port 5666  
01600 deny tcp from any to me dst-port 3306 in via bce0  
01700 divert 8668 ip from any to any via bce0  
01800 deny ip from 10.0.0.0/8 to any via bce0  
01900 deny ip from 172.16.0.0/12 to any via bce0  
02000 deny ip from 192.168.0.0/16 to any via bce0  
02100 deny ip from 0.0.0.0/8 to any via bce0  
02200 deny ip from 169.254.0.0/16 to any via bce0  
02300 deny ip from 192.0.2.0/24 to any via bce0  
02400 deny ip from 224.0.0.0/4 to any via bce0  
02500 deny ip from 240.0.0.0/4 to any via bce0  
02600 allow tcp from any to any established  
02700 allow ip from any to any frag  
02800 allow tcp from any to me dst-port 22 setup  
02900 allow tcp from any to me dst-port 25 setup  
03000 allow tcp from any to me dst-port 53 setup  
03100 allow udp from any to me dst-port 53  
03200 allow udp from me 53 to any  
03300 allow udp from any 53 to any  
03400 allow udp from any to any dst-port 53  
03500 allow tcp from any to me dst-port 80 setup  
03600 allow tcp from any to me dst-port 443 setup  
03700 allow icmp from me to any  
03800 allow tcp from any to any setup  
03900 allow udp from me to any dst-port 53 keep-state  
04000 allow udp from me to any dst-port 123 keep-state  
04100 allow log ip from any to any  
65535 deny ip from any to any  

am I missing something here - or shouldn't the traffic be allowed?

thanks for any help and please ask if information is missing.

1 Answer 1

1

turns out that the allow statement for mysql traffic "blocked" it, since it was prevented in reaching the divert rule that would do the actual forwarding.

testing was done by adding this rule :

ipfw add 1350 skipto 1700 tcp from a.b.c.e to me dst-port 3306

As a result rules 1400 and 1600 will be removed from our firewall and mysql replication will then remain happy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .