1

I'm setting up a test/lab environment for a team of developers who also happen to need a database. I've set up a Centos 7 VPS onto which I've installed the application server, the database and an Openvpn instance.

I'm using iptables to filter the traffic, and nothing but 1194/udp is exposed to the internet, I'm accepting just what i need from the tunnel interface. (I'm actually accepting 22/tcp from the internet temporarily, because i'm fiddling with the vpn config. I'm using ssh keys and root cannot remotely login anyway)

The problem is I can reach the server via SSH, and I also see the application landing page (which is served at 8080/tcp), but I can't connect to the database.

Here are the firewall rules:

[root@grolloserver ~]# iptables -nvL
Chain INPUT (policy DROP 198 packets, 19717 bytes)
 pkts bytes target     prot opt in     out     source               destination
48218 4934K f2b-SSH    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
25541 1143K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    3   120 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
72983   14M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
   31  1302 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194
    2  1570 ACCEPT     icmp --  tun0   *       0.0.0.0/0            0.0.0.0/0
    2    92 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    1    44 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080
    0     0 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3306
36412 3741K LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  128  6608 ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 1077 packets, 287K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain LOGGING (1 references)
 pkts bytes target     prot opt in     out     source               destination
36412 3741K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4 prefix "iptables dropped: "

Chain f2b-SSH (1 references)
 pkts bytes target     prot opt in     out     source               destination

Things I've tried:

  • Setting the default INPUT policy to ACCEPT - didn't work
  • Binding mariadb to eth0 and accepting (for 30 seconds) traffic from everywhere (I could connect to the db)
  • Binding mariadb to tun0 - didn't work
  • Binding mariadb to every interface (both by setting bind-address to 0.0.0.0 and by commenting it)
  • Stopping mariadb and setting sshd to listen to both 22 and 3306 (i couldn't connect to 3306)
  • Sniffing the traffic I see 3306/tcp coming from tun0, but putting a rule as INPUT #1 to log every 3306/tcp traffic didn't show anything

Firewalld is masked and stopped. SELinux is disabled. mssfix is set to 1430 (1470 which is the MTU with which i successfully ping the VPN gateway - 40).

Do you guys have any advice? Thanks.

EDIT: I forgot to mention, the connection times out after ~15 seconds. Iptables counters are at zero (I didn't reset them). ss -nal4 shows mariadb listening on the tun0 interface ip address.

  • What exactly is "didn't work" over here? How does the client behave when it does not connect? What do IPTables counters show immediately after setting up the rules and trying the connection? What does netstat -lnp show when MariaDB is running? Have you tried to use IP addresses instead of interface names in rules? – Tero Kilkanen Dec 29 '17 at 8:00
  • I forgot to mention, the connection times out after ~15 seconds. Iptables counters are at zero (I didn't reset them). ss -nal4 shows mariadb listening on the tun0 interface ip address. I didn't try to use ip addresses instead of iface names, I will try – greseth Dec 29 '17 at 9:39
  • Check the OpenVPN interface name. – Michael Hampton Dec 29 '17 at 21:39
  • It is correct. Besides, disabling iptables (or setting the default input policy to ACCEPT) didn't work either. – greseth Dec 29 '17 at 23:25
1

Solved! The problem was I had set a prerouting rule to NAT db requests to another db and of course, i forgot about it.

That is the reason the traffic didn't even reach the INPUT chain.

0

By default, Mariadb is not permitting remote loging. You should have a look to your configuration and i even think that also the databases should be granted in a way that you connect to them remotely. I've been there.

  • What do you mean when you say that it does not allow remote logging? I've set up binding on the VPN interface and a user@vpn_subnet. – greseth Dec 29 '17 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.