Unable to connect telnet to mysql listen ip port from remote host

Question

I m able to telnet locally to mysql process like below:

I have also made sure MySQL process is listening on all IPs by setting bind-address = 0.0.0.0 as evident below:

root@localhost:~# netstat -plutn | grep mysql
tcp        0      0 0.0.0.0:33060           0.0.0.0:*               LISTEN      39288/mysqld
tcp        0      0 0.0.0.0:7306            0.0.0.0:*               LISTEN      39288/mysqld

and

root@localhost:~# telnet 82.165.32.59 7306
Trying 82.165.32.59...
Connected to 82.165.32.59.
Escape character is '^]'.
>Host 'linux' is not allowed to connect to this MySQL serverConnection closed by foreign host

I opened the firewall port 7306 and reloaded the firewall using the below commands:

root@localhost:~# firewall-cmd --zone=public --permanent --add-port=7306/tcp
Warning: ALREADY_ENABLED: 7306:tcp
success
root@localhost:~#  firewall-cmd --reload
success
root@localhost:~# firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client ssh
  ports: 443/tcp 80/tcp 7306/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

However, when telnet from a remote host it fails like below:

$ telnet 82.165.32.59 7306
Trying 82.165.32.59...

telnet: connect to address 82.165.32.59: Connection timed out

My OS is:

root@localhost:~# uname -a
Linux localhost 5.4.0-89-generic #100-Ubuntu SMP Fri Sep 24 14:50:10 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

root@localhost:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.3 LTS
Release:        20.04
Codename:       focal

I tried restarting the firewall service as below:

root@localhost:~# systemctl restart firewalld

I also flushed the IPTABLES using the below script but it did not help:

root@localhost:~# cat fw.stop
#!/bin/sh
echo "Stopping IPv4 firewall and allowing everyone..."
ipt="/sbin/iptables"
## Failsafe - die if /sbin/iptables not found
[ ! -x "$ipt" ] && { echo "$0: \"${ipt}\" command not found."; exit 1; }
$ipt -P INPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -F
$ipt -X
$ipt -t nat -F
$ipt -t nat -X
$ipt -t mangle -F
$ipt -t mangle -X
$ipt -t raw -F
$ipt -t raw -X

I also checked if port 7306 is open for the outside world using the below website but it too says Port 7306 is closed on 82.165.32.59.

https://www.yougetsignal.com/tools/open-ports/

Below is the output of iptables -L however, I do not have the expertise to understand derive from it.

root@localhost:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED,DNAT
ACCEPT     all  --  anywhere             anywhere
INPUT_direct  all  --  anywhere             anywhere
INPUT_ZONES  all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED,DNAT
ACCEPT     all  --  anywhere             anywhere
FORWARD_direct  all  --  anywhere             anywhere
FORWARD_IN_ZONES  all  --  anywhere             anywhere
FORWARD_OUT_ZONES  all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
OUTPUT_direct  all  --  anywhere             anywhere

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination
FWDI_public  all  --  anywhere             anywhere            [goto]

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination
FWDO_public  all  --  anywhere             anywhere            [goto]

Chain FORWARD_direct (1 references)
target     prot opt source               destination

Chain FWDI_public (1 references)
target     prot opt source               destination
FWDI_public_pre  all  --  anywhere             anywhere
FWDI_public_log  all  --  anywhere             anywhere
FWDI_public_deny  all  --  anywhere             anywhere
FWDI_public_allow  all  --  anywhere             anywhere
FWDI_public_post  all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere

Chain FWDI_public_allow (1 references)
target     prot opt source               destination

Chain FWDI_public_deny (1 references)
target     prot opt source               destination

Chain FWDI_public_log (1 references)
target     prot opt source               destination

Chain FWDI_public_post (1 references)
target     prot opt source               destination

Chain FWDI_public_pre (1 references)
target     prot opt source               destination

Chain FWDO_public (1 references)
target     prot opt source               destination
FWDO_public_pre  all  --  anywhere             anywhere
FWDO_public_log  all  --  anywhere             anywhere
FWDO_public_deny  all  --  anywhere             anywhere
FWDO_public_allow  all  --  anywhere             anywhere
FWDO_public_post  all  --  anywhere             anywhere

Chain FWDO_public_allow (1 references)
target     prot opt source               destination

Chain FWDO_public_deny (1 references)
target     prot opt source               destination

Chain FWDO_public_log (1 references)
target     prot opt source               destination

Chain FWDO_public_post (1 references)
target     prot opt source               destination

Chain FWDO_public_pre (1 references)
target     prot opt source               destination

Chain INPUT_ZONES (1 references)
target     prot opt source               destination
IN_public  all  --  anywhere             anywhere            [goto]

Chain INPUT_direct (1 references)
target     prot opt source               destination

Chain IN_public (1 references)
target     prot opt source               destination
IN_public_pre  all  --  anywhere             anywhere
IN_public_log  all  --  anywhere             anywhere
IN_public_deny  all  --  anywhere             anywhere
IN_public_allow  all  --  anywhere             anywhere
IN_public_post  all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere

Chain IN_public_allow (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh ctstate NEW,UNTRACKED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https ctstate NEW,UNTRACKED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http ctstate NEW,UNTRACKED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:mysql ctstate NEW,UNTRACKED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:7306 ctstate NEW,UNTRACKED

Chain IN_public_deny (1 references)
target     prot opt source               destination

Chain IN_public_log (1 references)
target     prot opt source               destination

Chain IN_public_post (1 references)
target     prot opt source               destination

Chain IN_public_pre (1 references)
target     prot opt source               destination

Chain OUTPUT_direct (1 references)
target     prot opt source               destination

Can you please suggest?

Answer 1

The server was provisioned by https://cloudpanel.ionos.de/

After login into the portal, there was a firewall option on the webpage dashboard to allow access (incoming traffic) on port 7306.

I don't understand what was preventing the port to be accessed by a remote host if someone can shed some light on the answer.

After opting for that port restarted the server and now the port is connecting.

Many Thanks for your help.

Answer 2

It maybe a privilege restriction. If your allowed account is 'user'@'localhost', you should try telnet localhost 7306 locally.

You may also verify the presence of a 'user'@'%' Mysql user (or 'user'@'linux')

See also https://stackoverflow.com/questions/1559955/host-xxx-xx-xxx-xxx-is-not-allowed-to-connect-to-this-mysql-server

Note, I don’t expect something useful with a telnet connection. This port is maid to be connected with a Mysql client.