3

Is there a way to rate limit connections on MySQL 3306 by using IPTABLES? I'm thinking to allow 2 connection attemps to port 3306 every 5 minutes. Thanks

  • 2
    I have to ask why you'd want to do this. – David Pashley Oct 11 '09 at 19:28
  • we got some clients that run a desktop app that connects to mysql. we only want those desktop apps being able to connect and not dictionary attacks. – Josh Darrow Oct 11 '09 at 23:15
3

Would it not be better to keep these restrictions within MySQL itself, rather than on the network level? According to the MySQL documentation you can limit the following server resources for individual accounts:

*  The number of queries that an account can issue per hour
*  The number of updates that an account can issue per hour
*  The number of times an account can connect to the server per hour
*  The number of simultaneous connections to the server an account can have

An example MySQL query to do this:

mysql> CREATE USER 'francis'@'localhost' IDENTIFIED BY 'frank';
mysql> GRANT ALL ON customer.* TO 'francis'@'localhost'
    ->     WITH MAX_QUERIES_PER_HOUR 20
    ->          MAX_UPDATES_PER_HOUR 10
    ->          MAX_CONNECTIONS_PER_HOUR 5
    ->          MAX_USER_CONNECTIONS 2;

I'd personally prefer to keep this type of setting within the application itself, rather than trying to manipulate it without the applications knowledge. But from what I understand the other examples of using iptables should technically work too.

2
$IPT -A INPUT -s 0/0 -p tcp --dport 3306 --syn -m limit --limit 10/hour \

--limit-burst 10 -j ACCEPT


$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


$IPT -A INPUT -s 0/0 -p tcp --dport 3306 -j DROP
1

I was interested enough to do a search, found this article amongst others. Looks like you can do it.

0

Note that, depending on the application, limiting the amount of connections might not actually limit the amount of queries. There's nothing stopping the app from making hundreds of queries on a single connection, it's even best practice to do so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy