1

I have a linux server that many users connect to. I use Squid for http access but I need a software that can grant access control to different ports based on a MySQL database.

IPtables is great but I need something that will work with MySQL and grant control based on certain IF conditions.

Thanks

4
  • Can you go into a bit more detail about what kind of authentication you are trying to implement? Feb 7, 2012 at 14:57
  • It's a very simple one: IP authentication. I know IPtables allow you to set a range of allowed IP addresses. I need to do the same thing but based on a list of ip addresses in a database. In a sense, the authentication won't be done here. I just need an access control to do some Mysql query "query IP_list, if allow_IP exists, allow access; else Deny."
    – user106377
    Feb 7, 2012 at 15:15
  • 1
    Have you thought about the performance issues of trying to do this? Do you really want a mysql query run for every single packet?
    – Zoredache
    Feb 7, 2012 at 16:55
  • You are right. Is there any way to do a transparent SOCKS proxy?
    – user106377
    Feb 7, 2012 at 23:38

2 Answers 2

2

iptables permits you to do special processing per packet, by assigning the packet to the QUEUE chain; each packet must then be processed by a userland program that will decide the fate of the packet (Accept, drop, et-cetera). Writing such a handler is described here: http://imchris.org/projects/libipq.html. Because this technique involves making a routing decision per-packet in userland; it may have some serious throughput implications. If possible, you really should consider using ErikA's suggestion of just writing a script that manages rules as needed.

1

IPtables/netfilter is your only option. What you'll need is some custom script that manages netfilter rules according to information in your database.

I know of nothing that can do this out of the box. You'll likely need to roll this one yourself.

2
  • Thanks Erik. My question is how to make Iptables work with MySQL. Is there a plugin?
    – user106377
    Feb 7, 2012 at 15:16
  • Not that I know of, and even if there were, it would likely require a large amount of customization to get it to fit your needs.
    – EEAA
    Feb 7, 2012 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .