I'd like to add a "small" security to MySql server.

I want to leave open port 330, but only for internal purpose (localhost), and open another port (say 12345), that redirect to 3306.

So I need to add an iptable route that say "All incoming traffic from 12345 redirect to 3306 but close 3306 from direct outside incoming traffic" only on eth1 interface.

EDIT: How to close external INCOMING traffic on 3306 ?

  • I solved with: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $srcPortNumber -j REDIRECT --to-port $dstPortNumber – stighy Mar 28 at 8:48
  • 2
    Glad you figured out a solution. You can move your comment to an answer, and after a coulple days you can accept your own answer so that this question will disappear from the unanswered questions. – Mark Stewart Mar 29 at 13:36
  • 3
    This is called security by obscurity. It is not a good security. – ctrl-alt-delor Apr 1 at 10:48

If I understood well all your requirements, just do like this:

# assuming your network interface is named `eth1` as per your OP example

iptables -t raw -A PREROUTING -i eth1 -p tcp --dport 3306 -j DROP
iptables -t nat -A PREROUTING -p tcp --dport 12345 -j REDIRECT --to-port 3306

The first command prohibits connections incoming from eth1 towards tcp port 3306.

The second command redirects any incoming connection directed to local port 12345 towards local port 3306

If you have several interfaces all named like eth0, eth1, eth2, etc. and you’d like to block them all, you can obtain that by just specifying eth+ (note the plus sign) in the first command above, otherwise to selectively block only specific interfaces you’ll need to use that first command once per each interface to block.

The two commands above are those required to achieve your requested behavior, and may be enough depending on your overall needs.

However, for a more consistent experience I would advise an additional optional configuration:

iptables -t nat -A OUTPUT -o lo -p tcp --dport 12345 -j REDIRECT --to-port 3306

This redirects locally originated connections to local port 12345 towards local port 3306, so that you can connect to your mysql via port 12345 from the very same local machine too.

Finally, as an important side-note, keep in mind that -A option of iptables command appends rules the those already present, which therefore have precedence over the new ones appended, thus interfering with them.

So if you experiment with any iptables command, you might need to clear the involved tables at some point, and you can do it with -F option, like this:

iptables -t raw -F PREROUTING
iptables -t nat -F PREROUTING

# and possibly also
iptables -t nat -F OUTPUT
# if you also used the additional advised commmand

On the other hand, also keep in mind that these commands clear all rules present in those tables, including those that might have been there because of other firewalls in place. There are more fine grained commands to selectively delete specific rules, but these depend on your overall iptables setup, if it is very complex beyond the two simple rules seen here.

So you should always see first what your initial configuration is, and you can do so with the -L option of iptables, i.e. like this:

iptables -t raw -nL PREROUTING
iptables -t nat -nL PREROUTING

# and possibly also
iptables -t nat -nL OUTPUT
# if you also used the additional advised commmand

Of course you can use these any time, too, to see the current condition of your tables as you add rules. You may then like to add the v option (as in -nvL) to see counters for rules as they match (or don't match) network traffic over time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.