0

I've this iptables rules on first server which has the role of a client connecting to a second mysql server through LAN adapter.

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:44135]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Feb  4 20:33:41 2015
# Generated by iptables-save v1.4.7 on Wed Feb  4 20:33:41 2015
*nat
:PREROUTING ACCEPT [76:10856]
:POSTROUTING ACCEPT [11:734]
:OUTPUT ACCEPT [11:734]
COMMIT
# Completed on Wed Feb  4 20:33:41 2015
# Generated by iptables-save v1.4.7 on Wed Feb  4 20:33:41 2015
*mangle
:PREROUTING ACCEPT [2739:2511918]
:INPUT ACCEPT [2739:2511918]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1913:165876]
:POSTROUTING ACCEPT [1913:165876]
COMMIT

What's happening is that as soon as I do:

service iptables restart

it seems that all the MYSQL connections to a second server works correctly but only for a small period of time, usually 1-2 minutes, but in this 1 -2 minutes the connections to nginx (webserver, 80 port) doesn't work. After 1-2 minutes, it happens that webserver works and MYSQL doesn't work. Tryed iptables-save command too so far but nothing changed.

This is the firewall conf o second mysql server:

    *filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2785:425650]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -d 192.168.1.1/32 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i lo -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -p tcp -m tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
  • 1
    Which CentOS version? – MadHatter Feb 28 '15 at 7:29
0

You should be setting the default policy to DROP just in case your last catch-all rule is accidentally removed; like this :

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1:44135]

Now, on the second server.

-A INPUT -d 192.168.1.1/32 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT

This rule matches connections whose destination is 192.168.1.1, source port from 1024 to 65535, destination port 3306 and state new or established. You're overthinking this; if you want to allow MySQL connections you just have to match on the destination port and optionally add a source and/or interface parameter if you want to lock it down to a particular source IP or interface.

-A INPUT -i lo -p tcp -m tcp --dport 3306 -j ACCEPT

lo already has access because your first -A INPUT -i lo -j ACCEPT rule will match anything coming from the loopback.

-A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT

Okay now you're allowing the whole subnet, but that's already better and it should work.

-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT

Same as above, loopback is already allowed anyway.

-A INPUT -i eth1 -p tcp -m tcp --dport 3306 -j ACCEPT

Now you're allowing everything coming from eth1 with a destination port of 3306.

-A OUTPUT -p tcp -m tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT

Your OUTPUT policy is ACCEPT everything anyway, that rules is pointless.

I'm pretty sure your problem is because the state module has been deprecated and possibly removed, so your should use conntrack.

Recap :

First server :

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -j ACCEPT

Second server :

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth1 -s 192.168.1.0/24 -p tcp -m tcp --dport 3306 -m conntrack --ctstate NEW -j ACCEPT

This will allow all SSH connections and MySQL ones originating from eth1, 192.168.1.0/24. Feel free to change that.

  • I changed the iptables as described. Now the problem with MYSQL and NGINX not working at the same time disappeared but the changes continue to remain for a short period of time. After 1-2 minutes it seems that MYSQL connection terminates to work correctly. It seems like all the changes are authomatically lost after a while. – Claudio Ferraro Feb 28 '15 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.