1

I am setting up a simple server architecture: 1 application server (LAMPserver) and 1 database server (DBserver). At this stage everything is working (I can connect to my DBserver from my LAMPserver). But when I set up my iptables rules on my DBserver; I cannot connect anymore. My iptables rules for the LAMPserver are:

#!/bin/sh

# Remove all rules
iptables -t filter -F
iptables -t filter -X

# Forbid all traffic
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

# Allow established connection
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

# Allow HTTP
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow HTTPS
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow SSH
iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT

# Mysql
iptables -t filter -A OUTPUT -p tcp --dport 3306 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT

# Allow FTP
iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT

# Allow SMTP
iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 587 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 587 -j ACCEPT

# Allow POP3
iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT

# Allow POPS
iptables -t filter -A OUTPUT -p tcp --dport 995 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 995 -j ACCEPT
# Allow POPS
iptables -t filter -A OUTPUT -p tcp --dport 995 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 995 -j ACCEPT

# Allow IMAP
iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT

# Allow IMAPS
iptables -t filter -A OUTPUT -p tcp --dport 993 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 993 -j ACCEPT

# Allow DNS
iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --sport 53 -j ACCEPT

# Allow ICMP (ping)
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# NTP (horloge du serveur)
sudo iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

# Prevent Flood or Ddos
iptables -A FORWARD -p tcp --syn -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT

# Limit port scan
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

I based port 3306 iptables on a @MadHatter post: IPTables: Allow outgoing MySQL connections but not incoming connections

The issue is with my DB server. If I do not use any iptables it is working fine; but when I use the following iptables I cannot get it to work.

#!/bin/sh

# Remove all rules
iptables -t filter -F
iptables -t filter -X

# Forbid all traffic
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

# Allow established connection
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

# Allow HTTP
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow HTTPS
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow SSH
iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT 
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT

# Mysql
iptables -A INPUT -p tcp -s IP-DBserver --sport 1024:65535 -d IP-LAMPserver --dport 3306 -m stat$
iptables -A OUTPUT -p tcp -s IP-LAMPserver --sport 3306 -d IP-DBserver --dport 1024:65535 -m sta$

# Allow DNS
iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --sport 53 -j ACCEPT

# Allow ICMP (ping)
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# NTP (horloge du serveur)
sudo iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

# Prevent Flood or Ddos
iptables -A FORWARD -p tcp --syn -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT

# Limit port scan
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

Any ideas?

2
  • By default, MySQL server does not listen on any IP address, instead it uses a local socket. Have you checked that the server is listening on port 3306?
    – NuTTyX
    Sep 10, 2015 at 16:18
  • Thanks; Yes I checked; the issue is related to iptables; I found the solution; see below. Thanks for helping
    – user269327
    Sep 10, 2015 at 16:20

1 Answer 1

1

OK the solution was already on serverfault by @MadHatter

IPTables: Allow outgoing MySQL connections but not incoming connections

iptables -t filter -A OUTPUT -p tcp --dport 3306 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT
1
  • Those rules seems to apply to the mysql client. What it seems is that you are trying to connect to the IP address of your server (instead of loopback which is the most common configuration) and your original ruleset did not include a rule to open an OUTcomming to the 3306 port. You would only need the first rule if those last two.
    – NuTTyX
    Sep 10, 2015 at 16:36