0

I want to block port 3306 for everyone in bsd system and open it for one ip address using a firewall in the freebsd.

I tried something like this but the port closes and the addresses are not open.

## our interface ##
ext_if="em0"

## do not block mysqld on ##
mysqld_ip="{ !202.54.1.2, !202.54.1.10, !202.54.1.15 }" <<< don't open when i write address ip

## Block everything for tcp port number 3306 except $mysqld_ip  ###
block in on $ext_if proto tcp from any to  $mysqld_ip port 3306

Does anyone know how to make this firewall work well?

1

Last rule to match a packet wins unless the rule is specialized with quick.

So this is what I would do

mysqld_ip="{ 202.54.1.2, 202.54.1.10, 202.54.1.15 }"
pass in quick on $ext_if inet proto tcp from any to $mysqld_ip port 3306 keep state
block in on $ext_if inet proto tcp from any to any port 3306

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.