Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

mysql real port is 3306

I want public network using 53306 to visit mysql, and 3306 is not allowed access from public network.

How to write the iptables rules DNAT 53306 to 127.0.0.1 3306?

share|improve this question

1 Answer 1

Try:

iptables -t nat -A PREROUTING -p tcp -d <public IP> --dport 53306 -j DNAT --to-destination 127.0.0.1:3306

What this rule does is:

  • -t nat indicate the nat table
  • -A PREROUTING meaning append this rule to bottom of PREROUTING chain
  • -p tcp specific this rule only apply for tcp protocol
  • -d <public IP> --dport 53306 meaning match all traffic to public ip and to port 53306.
  • -j DNAT meaning jump to DNAT target
  • --to-destination 127.0.0.1:3306 specify your local ip and port
share|improve this answer
    
Instead of public IP 0.0.0.0 is also an option, albeit less specific. –  0xC0000022L Jul 1 at 10:27
    
@gnouc does that actually work? Can you DNAT to an IP that's on the same machine? –  Creek Jul 1 at 14:11
    
@Creek: It's alone may not work, since when packet to localhost simply drop by iptables. I think we need enable route_localnet. –  Gnouc Jul 1 at 16:11
    
@Gnouc Maybe. I was thinking that the packet would traverse the INPUT chain instead of FORWARD and never reach 127.0.0.1 –  Creek Jul 1 at 16:17
    
@Creek You are right, IN IP Secrity Protocol,packet never reach loopback address. –  ikool Jul 2 at 3:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.