I have a linux server that many users connect to. I use Squid for http access but I need a software that can grant access control to different ports based on a MySQL database.

IPtables is great but I need something that will work with MySQL and grant control based on certain IF conditions.


  • Can you go into a bit more detail about what kind of authentication you are trying to implement? – SingleNegationElimination Feb 7 '12 at 14:57
  • It's a very simple one: IP authentication. I know IPtables allow you to set a range of allowed IP addresses. I need to do the same thing but based on a list of ip addresses in a database. In a sense, the authentication won't be done here. I just need an access control to do some Mysql query "query IP_list, if allow_IP exists, allow access; else Deny." – user106377 Feb 7 '12 at 15:15
  • 1
    Have you thought about the performance issues of trying to do this? Do you really want a mysql query run for every single packet? – Zoredache Feb 7 '12 at 16:55
  • You are right. Is there any way to do a transparent SOCKS proxy? – user106377 Feb 7 '12 at 23:38

iptables permits you to do special processing per packet, by assigning the packet to the QUEUE chain; each packet must then be processed by a userland program that will decide the fate of the packet (Accept, drop, et-cetera). Writing such a handler is described here: http://imchris.org/projects/libipq.html. Because this technique involves making a routing decision per-packet in userland; it may have some serious throughput implications. If possible, you really should consider using ErikA's suggestion of just writing a script that manages rules as needed.


IPtables/netfilter is your only option. What you'll need is some custom script that manages netfilter rules according to information in your database.

I know of nothing that can do this out of the box. You'll likely need to roll this one yourself.

  • Thanks Erik. My question is how to make Iptables work with MySQL. Is there a plugin? – user106377 Feb 7 '12 at 15:16
  • Not that I know of, and even if there were, it would likely require a large amount of customization to get it to fit your needs. – EEAA Feb 7 '12 at 15:17

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.