Looking to make a mysql database server for web-servers. The server has a public & private interface and I need some assistance writing the rules.

I want to only allow SSH, mysql via private interface, and shutdown the public interface essentially

iptables -nL -v --line-numbers

Allow Public and Private if initiated by server.

iptables -I INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Allow Loopback to localhost

iptables -A INPUT -i lo -j ACCEPT

Block all incoming traffic via public interface.


Block all SSH via public interface

iptables -A INPUT -i eth0 -p tcp --destination-port 22 -j DROP

Allow SSH via private interface from 1 IP.

iptables -A INPUT -p tcp -s PRIVATE_IP --dport 22 -i eth1 -j ACCEPT

Allow mysql via private interface from specific IP. Reject mysql via eth0 (public)

iptables -A INPUT -i eth1 -p tcp --dport mysql -s PRIVATE_IP -j ACCEPT

iptables -A INPUT -i eth0 -p tcp -m tcp --dport mysql -j REJECT

Allow Ping on eth1 (private), but not eth0 (public)

iptables -A INPUT -i eth1 -p icmp -j ACCEPT
iptables -A INPUT -i eth0 -p icmp -j REJECT

Drop Public connections

iptables -A INPUT -i eth0 -j DROP

Do I have all my bases covered?

  • 1
    If you aren't planning on having mysql accessible on the public interface, bind it to the private interface in the mysql config. Same goes for ssh.
    – RSchulze
    Jul 28, 2015 at 5:45

2 Answers 2


Do I have all my bases covered?

When speaking of a public facing server, one should never think to be ultimately safe; other than that, I would set a DROP policy for the INPUT chain, and after that allow only what is really required. For example, after a

iptables -P INPUT DROP

it wouldn't be necessary to specify the

iptables -A INPUT -i eth0 -p tcp -m tcp --dport mysql -j REJECT

If you're not going to use the interface why not disable it (or not start it) ?

You don't say which distro you are using but they should all have a way of not starting an interface when the system boots.

For RHEL/CentOS etc you can set ONBOOT=no in the relevant file in /etc/sysconfig/network-scripts

For Debian/Ubuntu etc you can set iface InterfaceName inet manual in /etc/network/interfaces.

Interface activation takes place early in the boot process sssd|mysqld won't have an interface to bind to but it may also be advisable to configure sshd and mysqld to only listen on the relevant addresses, check out the ListenAddress and bind-address options in their respective documentation.

You can also disable the interfaces from the command line using ip ifconfig (deprecated).

ip link set eth1 down


ifconfig eth0 down
  • If you shut down the public interface (and maybe a different gateway is not available) how are you going to access the Internet? (The question says alllow through public if initiated by the server, so it seems is used after all).
    – S19N
    Aug 7, 2015 at 9:14
  • @S19N Third line after the comma and shutdown the public interface essentially. The rest just looks like commentary on the iptables rules rather than requirements.
    – user9517
    Aug 7, 2015 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .