On my database server (CentOS 7) I want to allow access to port 3306 (MySQL) from specific web front-ends ( and in my example). On top of that I want to allow access to port 22 (SSH) from all hosts. I'm managing my configuration through editing the XML zone files in /etc/firewalld/zones/, so I can easily distribute them to different systems.


This is my zone configuration:

<?xml version="1.0" encoding="utf-8"?>
  <short>DB Host</short>
  <description>Communication to SSH and MySQL.</description>
  <interface name="eth0"/>
  <rule family="ipv4">
    <port port="22" protocol="tcp"/>
  <rule family="ipv4">
    <source address=","/>
    <port port="3306" protocol="tcp"/>


When I portscan the machine from one of my web front-ends I can see that port 3306 is open, but port 22 remains closed:

Starting Nmap 6.40 ( http://nmap.org ) at 2015-05-05 16:21 CEST
Nmap scan report for
Host is up (0.00026s latency).
22/tcp   filtered ssh
3306/tcp open     mysql

Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds


What would be the proper configuration here?

Please mind that I want to restrict port 3306 to specific hosts, while keeping port 22 open for all hosts.


you can use something like this:

firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 22 -j ACCEPT 
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 3306 -s -j ACCEPT
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.