0

I have two containers on virtualization host that has "LAN" bridge (vmbr1) and "WAN" bridge (vmbr0).

Virtualization host has public IP (lets assume dummy 123.123.123.123) configured on vmbr0 bridge.

Inside this virtualization host I have two containers:

  • web container (10.1.0.210/24)
  • database container (10.1.0.250/24)

Web container is using mysql database. It is configured to connect 10.1.0.250:3306.

In mysql I have user for web application, which is allowed to connect only from web host (10.1.0.210).

Everything was working fine until I have added these NAT rules (supposed to allow connections from WAN). This is from my /etc/network/interfaces vmbr1 (LAN) configuration:

# there is no need to add -m multiport here, these rules are from my "template"
# post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp -m multiport --dport 3306 -j DNAT --to-destination 10.5.0.250
# post-up iptables -t nat -A POSTROUTING -o vmbr1 -p tcp -m multiport --dport 3306 -d 10.5.0.250 -j SNAT --to-source 10.5.0.1
# pre-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp -m multiport --dport 3306 -j DNAT --to-destination 10.5.0.250
# pre-down iptables -t nat -D POSTROUTING -o vmbr1 -p tcp -m multiport --dport 3306 -d 10.5.0.250 -j SNAT --to-source 10.5.0.1

The problem is that when I add these rules to iptables:

iptables -t nat -A PREROUTING -i vmbr0 -p tcp -m multiport --dport 3306 -j DNAT --to-destination 10.5.0.250
iptables -t nat -A POSTROUTING -o vmbr1 -p tcp -m multiport --dport 3306 -d 10.5.0.250 -j SNAT --to-source 10.5.0.1

my web application stops working, because mysql throws login error when web application tries to connect. From mysql point of view the connection is coming from 10.1.0.1 address (gateway on LAN side) instead of real 10.1.0.210 (mysql user [email protected] is allowed to connect, but user [email protected] is not allowed).

I guess this is because all connections o 3306 port now go thru NAT and NAT translates 10.1.0.210 to 10.1.0.1.

How can I fix this?

Probably I should "narrow" these nat rules to work only when connection comes only from WAN, but I have not enough knowledge about networks and iptables to mess it up on production server.

1 Answer 1

Reset to default
1

It sounds like the problem is that the NAT rules you've added are causing the source IP address of the connections coming from your web container to be changed to the gateway's IP address on the LAN side (10.1.0.1) instead of the web container's actual IP address (10.1.0.210). This is causing the MySQL server to reject the connections because they are coming from an IP address that is not allowed to connect.

One solution to this problem could be to add an additional iptables rule before the DNAT and SNAT rules that checks the source IP address of the incoming connections and only applies the DNAT and SNAT rules if the connections are coming from the WAN. You can use the "-s" option to specify the source IP address and the "-j" option to specify the target of the rule (in this case, the DNAT and SNAT rules).

Another solution could be to configure your web container to connect to MySQL server via the public IP address of the virtualization host, instead of the internal IP address of the database container. This way, the NAT rules would not affect the connection.

Also you can check if your mysql has option to set bind-address to 0.0.0.0 instead of 10.1.0.250, this way it will listen to all the interfaces and it will not be affected by the NAT rules.

7
  • Could you please explain in detail or show how I can write that "additional iptables rule before the DNAT and SNAT rules that checks the source IP address of the incoming connections and only applies the DNAT and SNAT rules if the connections are coming from the WAN"?
    – Kamil
    Jan 14 at 4:32
  • You can use the iptables command to check the source IP of incoming connections & only apply the DNAT & SNAT rules if the connections are from the WAN: -I PREROUTING 1 -i vmbr0 -s ! 10.1.0.0/24 -p tcp --dport 3306 -j ACCEPT. Then add the DNAT & SNAT rules to forward traffic to the right destination & source IP addresses. Double-check IPs, interfaces & ports relevant to your setup & test the new rules before applying them on a production server. Also, have a backup of current iptables config or snapshot of your VM before making any changes.
    – Mix tutor
    Jan 14 at 14:15
  • I don't get it. Are you sure that the rule part you wrote with NOT! 10.1.0.0/24 action should be ACCEPT? I think it should be without that negation exclamation mark. But maybe I'm wrong. My understanding of this is that only one rule applies to packet - the first from top that matches a packet. Is this correct?
    – Kamil
    Jan 14 at 23:34
  • The rule I provided should be: iptables -t nat -I PREROUTING 1 -i vmbr0 -s 10.1.0.0/24 -p tcp --dport 3306 -j ACCEPT This rule will match the packets coming from LAN and will accept them. Packets that don't match this rule, will be processed by the next rule, which is the DNAT rule: iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 3306 -j DNAT --to-destination 10.5.0.250
    – Mix tutor
    Jan 14 at 23:43
  • Ok, now that's makes sense. But I have one more doubt. Your rule accepts, but but should this rule go to -t nat table? I't shouldn't be in forward table?
    – Kamil
    Jan 14 at 23:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .