using firewall to block port

shantanuo · February 16, 2009, 6:37am

Hi,
I will like to allow access to the mysql port (3306) to certain IP address. All other IP's should be automatically blocked. What is the best way to do this?

otheus · February 16, 2009, 9:56am

What OS does your mysql server run on?

shantanuo · February 16, 2009, 11:10am

Red Hat Enterprise

otheus · February 17, 2009, 4:47am

So you actually meant to say "Linux"

Try this (as root):

MYIPADDR=<the IP address you want to allow>

PATH=/sbin:$PATH
iptables -A INPUT -p tcp --dport 3306 -s $MYIPADDR -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j REJECT
service iptables save

If you screw up, flush the rules and try again. Flush with:

iptables -F INPUT

shantanuo · February 17, 2009, 7:04am

Hi,
I tried the following and it is working as expected. Thanks.

iptables -F INPUT
iptables -A INPUT -p tcp --dport 3306 -s $'172.29.0.2' -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -s $'172.29.0.1' -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j REJECT
service iptables save

But I have to allow one IP address at a time. It does not accept comma
How do I add multiple IP addresses?

otheus · February 17, 2009, 7:34am

You did it right. If your IP addresses encompass a range, you can do a netmask, such as 172.29.0.0/24.

I don't know what the $ signs are for (in my example, they were for a shell variable)... take them out just in case.

pludi · February 17, 2009, 7:52am

Either with

$ iptables -A INPUT -p tcp --dport 3306 -s '172.29.0.1/<cidr>' -j ACCEPT

or, if you have the iprange module with

$ iptables -A INPUT -p tcp --dport 3306 --src-range <first ip>-<last-ip> -j ACCEPT

palakanit · February 17, 2009, 9:17am

thnx for sharing all the configuration steps.

Lordlava · March 22, 2009, 9:09pm

I used the above examples and I have got what I needed to work. Thanks.

I could not get the multiple IP adrdresses working or the REJECT line but hopefully I will not need them.

Lordlava