mysql real port is 3306

I want public network using 53306 to visit mysql, and 3306 is not allowed access from public network.

How to write the iptables rules DNAT 53306 to 3306?



iptables -t nat -A PREROUTING -p tcp -d <public IP> --dport 53306 -j DNAT --to-destination

What this rule does is:

  • -t nat indicate the nat table
  • -A PREROUTING meaning append this rule to bottom of PREROUTING chain
  • -p tcp specific this rule only apply for tcp protocol
  • -d <public IP> --dport 53306 meaning match all traffic to public ip and to port 53306.
  • -j DNAT meaning jump to DNAT target
  • --to-destination specify your local ip and port
  • Instead of public IP is also an option, albeit less specific. – 0xC0000022L Jul 1 '14 at 10:27
  • @gnouc does that actually work? Can you DNAT to an IP that's on the same machine? – Creek Jul 1 '14 at 14:11
  • @Creek: It's alone may not work, since when packet to localhost simply drop by iptables. I think we need enable route_localnet. – cuonglm Jul 1 '14 at 16:11
  • @Gnouc Maybe. I was thinking that the packet would traverse the INPUT chain instead of FORWARD and never reach – Creek Jul 1 '14 at 16:17
  • @Creek You are right, IN IP Secrity Protocol,packet never reach loopback address. – ikool Jul 2 '14 at 3:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.