0

I m able to telnet locally to mysql process like below:

I have also made sure MySQL process is listening on all IPs by setting bind-address = 0.0.0.0 as evident below:

root@localhost:~# netstat -plutn | grep mysql
tcp        0      0 0.0.0.0:33060           0.0.0.0:*               LISTEN      39288/mysqld
tcp        0      0 0.0.0.0:7306            0.0.0.0:*               LISTEN      39288/mysqld

and

root@localhost:~# telnet 82.165.32.59 7306
Trying 82.165.32.59...
Connected to 82.165.32.59.
Escape character is '^]'.
>Host 'linux' is not allowed to connect to this MySQL serverConnection closed by foreign host

I opened the firewall port 7306 and reloaded the firewall using the below commands:

root@localhost:~# firewall-cmd --zone=public --permanent --add-port=7306/tcp
Warning: ALREADY_ENABLED: 7306:tcp
success
root@localhost:~#  firewall-cmd --reload
success
root@localhost:~# firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client ssh
  ports: 443/tcp 80/tcp 7306/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

However, when telnet from a remote host it fails like below:

$ telnet 82.165.32.59 7306
Trying 82.165.32.59...

telnet: connect to address 82.165.32.59: Connection timed out

My OS is:

root@localhost:~# uname -a
Linux localhost 5.4.0-89-generic #100-Ubuntu SMP Fri Sep 24 14:50:10 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

root@localhost:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.3 LTS
Release:        20.04
Codename:       focal

I tried restarting the firewall service as below:

root@localhost:~# systemctl restart firewalld

I also flushed the IPTABLES using the below script but it did not help:

root@localhost:~# cat fw.stop
#!/bin/sh
echo "Stopping IPv4 firewall and allowing everyone..."
ipt="/sbin/iptables"
## Failsafe - die if /sbin/iptables not found
[ ! -x "$ipt" ] && { echo "$0: \"${ipt}\" command not found."; exit 1; }
$ipt -P INPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -F
$ipt -X
$ipt -t nat -F
$ipt -t nat -X
$ipt -t mangle -F
$ipt -t mangle -X
$ipt -t raw -F
$ipt -t raw -X

I also checked if port 7306 is open for the outside world using the below website but it too says Port 7306 is closed on 82.165.32.59.

https://www.yougetsignal.com/tools/open-ports/

Below is the output of iptables -L however, I do not have the expertise to understand derive from it.

root@localhost:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED,DNAT
ACCEPT     all  --  anywhere             anywhere
INPUT_direct  all  --  anywhere             anywhere
INPUT_ZONES  all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED,DNAT
ACCEPT     all  --  anywhere             anywhere
FORWARD_direct  all  --  anywhere             anywhere
FORWARD_IN_ZONES  all  --  anywhere             anywhere
FORWARD_OUT_ZONES  all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
OUTPUT_direct  all  --  anywhere             anywhere

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination
FWDI_public  all  --  anywhere             anywhere            [goto]

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination
FWDO_public  all  --  anywhere             anywhere            [goto]

Chain FORWARD_direct (1 references)
target     prot opt source               destination

Chain FWDI_public (1 references)
target     prot opt source               destination
FWDI_public_pre  all  --  anywhere             anywhere
FWDI_public_log  all  --  anywhere             anywhere
FWDI_public_deny  all  --  anywhere             anywhere
FWDI_public_allow  all  --  anywhere             anywhere
FWDI_public_post  all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere

Chain FWDI_public_allow (1 references)
target     prot opt source               destination

Chain FWDI_public_deny (1 references)
target     prot opt source               destination

Chain FWDI_public_log (1 references)
target     prot opt source               destination

Chain FWDI_public_post (1 references)
target     prot opt source               destination

Chain FWDI_public_pre (1 references)
target     prot opt source               destination

Chain FWDO_public (1 references)
target     prot opt source               destination
FWDO_public_pre  all  --  anywhere             anywhere
FWDO_public_log  all  --  anywhere             anywhere
FWDO_public_deny  all  --  anywhere             anywhere
FWDO_public_allow  all  --  anywhere             anywhere
FWDO_public_post  all  --  anywhere             anywhere

Chain FWDO_public_allow (1 references)
target     prot opt source               destination

Chain FWDO_public_deny (1 references)
target     prot opt source               destination

Chain FWDO_public_log (1 references)
target     prot opt source               destination

Chain FWDO_public_post (1 references)
target     prot opt source               destination

Chain FWDO_public_pre (1 references)
target     prot opt source               destination

Chain INPUT_ZONES (1 references)
target     prot opt source               destination
IN_public  all  --  anywhere             anywhere            [goto]

Chain INPUT_direct (1 references)
target     prot opt source               destination

Chain IN_public (1 references)
target     prot opt source               destination
IN_public_pre  all  --  anywhere             anywhere
IN_public_log  all  --  anywhere             anywhere
IN_public_deny  all  --  anywhere             anywhere
IN_public_allow  all  --  anywhere             anywhere
IN_public_post  all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere

Chain IN_public_allow (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh ctstate NEW,UNTRACKED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https ctstate NEW,UNTRACKED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http ctstate NEW,UNTRACKED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:mysql ctstate NEW,UNTRACKED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:7306 ctstate NEW,UNTRACKED

Chain IN_public_deny (1 references)
target     prot opt source               destination

Chain IN_public_log (1 references)
target     prot opt source               destination

Chain IN_public_post (1 references)
target     prot opt source               destination

Chain IN_public_pre (1 references)
target     prot opt source               destination

Chain OUTPUT_direct (1 references)
target     prot opt source               destination

Can you please suggest?

10
  • This is not a mysql issue, it's a network problem. Completely stop firewalld and flush iptables and see if the port is accessible via telnet from the outside. This would save lots of troubleshooting. Restore the firewall configuration after testing
    – Alex
    Nov 10, 2021 at 15:13
  • @Alex i updated the original post where i restarted the firewalld service and flushed the iptables. Can you please verify and suggest further?
    – Ashar
    Nov 10, 2021 at 16:22
  • Are you on an enterprise network? The 'Connection timed out' error could be due to a network-level firewall between your two systems.
    – Haxiel
    Nov 10, 2021 at 16:26
  • I m able to telnet to port 22 if that answers the question @Haxiel
    – Ashar
    Nov 10, 2021 at 17:07
  • Your fw.stop seems ok, but a iptables -L can verify its action. If all is ok about the iptables, a reboot of the server, hopping to get the first type of problem back instead of this lower new problem may help. Nov 10, 2021 at 17:31

2 Answers 2

0

The server was provisioned by https://cloudpanel.ionos.de/

After login into the portal, there was a firewall option on the webpage dashboard to allow access (incoming traffic) on port 7306.

I don't understand what was preventing the port to be accessed by a remote host if someone can shed some light on the answer.

After opting for that port restarted the server and now the port is connecting.

Many Thanks for your help.

-1

It maybe a privilege restriction. If your allowed account is 'user'@'localhost', you should try telnet localhost 7306 locally.

You may also verify the presence of a 'user'@'%' Mysql user (or 'user'@'linux')

See also https://stackoverflow.com/questions/1559955/host-xxx-xx-xxx-xxx-is-not-allowed-to-connect-to-this-mysql-server

Note, I don’t expect something useful with a telnet connection. This port is maid to be connected with a Mysql client.

10
  • 1
    mysql user permissions have nothing to do with connecting to a port over tcp
    – Alex
    Nov 10, 2021 at 15:15
  • Should to focus be on OS firewalls stuff or mysql ?
    – Ashar
    Nov 10, 2021 at 15:15
  • Agreed @Alex requesting other solutions
    – Ashar
    Nov 10, 2021 at 15:17
  • 1
    Telnet did manage to connect to Mysql. The proof is the string returned by Mysql (Host 'linux' is not allowed to connect to this MySQL server). The issue is at a level above TCP, then having a look in the privileges tables seems a good idea. [note : TCP is not able to indicate a custom error string like this one] Nov 10, 2021 at 15:28
  • @FrédéricLoyer you are looking at the output of telnet locally not the one fired from the remote hots.
    – Ashar
    Nov 10, 2021 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.