Linode Forum
Linode Community Forums 		 FAQFAQ    SearchSearch    MembersMembers      Register Register 
 LoginLogin [ Anonymous ] 
Post new topic  Reply to topic

Board index » Linux Community Forums » Linux Networking
  Print view Previous topic | Next topic 
Author Message
nateleavitt
PostPosted: Tue Nov 18, 2008 3:33 pm 
Offline
Newbie

Joined: Tue Nov 18, 2008 3:22 pm
Posts: 3
Hey guys! I'm trying to get some database replication working across linodes using the local ip addresses. For some reason I can't get the mysql port open for local network address.

Here is my nmap scan at my local address:
Code:
Not shown: 1711 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
443/tcp  closed https
3306/tcp closed mysql


Here is my iptable script:
Code:
*mangle
:PREROUTING ACCEPT [444:43563]
:INPUT ACCEPT [444:43563]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [402:144198]
:POSTROUTING ACCEPT [402:144198]
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
COMMIT
*filter
:INPUT DROP [1:242]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:LOG_DROP - [0:0]
:LOG_ACCEPT - [0:0]
:icmp_packets - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 7337 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp --dport 3306 -j ACCEPT
-A INPUT -s 127.0.0.1 -j ACCEPT
-A INPUT -p icmp -j icmp_packets
-A INPUT -j LOG_DROP

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 23 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 43 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 43 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9418 -j ACCEPT
-A OUTPUT -d 127.0.0.1 -j ACCEPT
-A OUTPUT -p icmp -j icmp_packets
-A OUTPUT -j LOG_DROP
COMMIT


And here is my ifconfig: (i changed the local & public address to end with 123)
Code:
eth0      Link encap:Ethernet  HWaddr fe:fd:48:0e:b3:4b  
          inet addr:72.14.179.123  Bcast:72.14.179.255  Mask:255.255.255.0
          inet6 addr: fe80::fcfd:48ff:fe0e:b34b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:279707 errors:0 dropped:0 overruns:0 frame:0
          TX packets:68914 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:37406169 (35.6 MB)  TX bytes:44425519 (42.3 MB)

eth1      Link encap:Ethernet  HWaddr fe:fe:c0:a8:87:97  
          inet addr:192.168.135.123  Bcast:192.168.255.255  Mask:255.255.128.0
          inet6 addr: fe80::fcfe:c0ff:fea8:8797/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:18727 errors:0 dropped:0 overruns:0 frame:0
          TX packets:63 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1736287 (1.6 MB)  TX bytes:3898 (3.8 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:12188 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12188 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:656956 (641.5 KB)  TX bytes:656956 (641.5 KB)


I have edited my.conf to include the bind address of: 192.168.135.123.

Any help or pointers would be much appreciated.


Last edited by nateleavitt on Wed Nov 19, 2008 12:45 pm, edited 1 time in total.

Top
   
Reply with quote  
Internat
 Post subject:
PostPosted: Tue Nov 18, 2008 5:27 pm 
Offline
Senior Member
User avatar

Joined: Tue Aug 17, 2004 11:37 pm
Posts: 262
Website: http://www.our-lan.com
WLM: nf@our-lan.com
Location: Brisbane, Australia
i assume you restarted mysql after you bound it to the ip right?
and that you removed the, option for skip-local-networking? or skip-networking? i cant remember the exact one

_________________
ServerAdmin - www.our-lan.com
"Diplomacy is the art of saying nice doggy whilst looking for a really big stick"
"In my experiece, any attempt to make any system idiot proof will only challenge God to make a better idiot"
Top
   
Reply with quote  
Xan
 Post subject:
PostPosted: Tue Nov 18, 2008 11:36 pm 
Offline
Senior Member
User avatar

Joined: Sun Feb 08, 2004 7:18 pm
Posts: 562
Location: Austin
The more recent MySQL releases use:
Code:
bind-address=127.0.0.1

in the config file by default. Change this from the local IP to the one you'd like to use.
Top
   
Reply with quote  
hybinet
 Post subject:
PostPosted: Wed Nov 19, 2008 1:06 am 
Offline
Senior Member

Joined: Fri May 02, 2008 8:44 pm
Posts: 1121
Xan wrote:
The more recent MySQL releases use:
Code:
bind-address=127.0.0.1

in the config file by default. Change this from the local IP to the one you'd like to use.


That will probably prevent MySQL from being accessible from localhost. In addition, I don't think it's currently possible to make MySQL bind to only two interfaces. (i.e. You can't have two "bind-address" directives.) MySQL binds either to only one interface or to all available interfaces.

So just comment out the whole "bind-address" line in my.cnf. That'll make MySQL bind to all interfaces. Then you can use your firewall to make port 3306 only accessible from your other server.
Top
   
Reply with quote  
Xan
 Post subject:
PostPosted: Wed Nov 19, 2008 1:13 am 
Offline
Senior Member
User avatar

Joined: Sun Feb 08, 2004 7:18 pm
Posts: 562
Location: Austin
It'll still be accessible via the Unix socket, so the command-line client will still work fine.
Top
   
Reply with quote  
MrRx7
 Post subject:
PostPosted: Wed Nov 19, 2008 5:57 am 
Offline
Junior Member

Joined: Wed May 21, 2008 5:34 am
Posts: 46
Website: http://www.eve-razor.com/forum
Location: Austin, Tx
Like previously mentioned your best bet is to comment out the bind to ip address option and just firewall to only allow inbound connects to 3306 from the ip address of your other server.

Also make sure any sql accounts with the host of '%' are password protected.
Top
   
Reply with quote  
nateleavitt
 Post subject:
PostPosted: Wed Nov 19, 2008 12:28 pm 
Offline
Newbie

Joined: Tue Nov 18, 2008 3:22 pm
Posts: 3
hybinet wrote:
Xan wrote:
The more recent MySQL releases use:
Code:
bind-address=127.0.0.1

in the config file by default. Change this from the local IP to the one you'd like to use.


That will probably prevent MySQL from being accessible from localhost. In addition, I don't think it's currently possible to make MySQL bind to only two interfaces. (i.e. You can't have two "bind-address" directives.) MySQL binds either to only one interface or to all available interfaces.

So just comment out the whole "bind-address" line in my.cnf. That'll make MySQL bind to all interfaces. Then you can use your firewall to make port 3306 only accessible from your other server.


right now I have

Code:
bind-address=127.0.0.1 192.168.135.123


I thought you could bind multiple addresses. I'll try removing it to see if that would work.
Top
   
Reply with quote  
nateleavitt
 Post subject:
PostPosted: Wed Nov 19, 2008 12:45 pm 
Offline
Newbie

Joined: Tue Nov 18, 2008 3:22 pm
Posts: 3
ok guys...

I removed the bind-address and it's now open! I just added the following rule to only open port 3306 for the local network interface:

Code:
-A INPUT -i eth1 -p tcp -m tcp --dport 3306 -j ACCEPT


Thanks for the suggestions guys!
Top
   
Reply with quote  
MrRx7
 Post subject:
PostPosted: Thu Nov 20, 2008 3:20 am 
Offline
Junior Member

Joined: Wed May 21, 2008 5:34 am
Posts: 46
Website: http://www.eve-razor.com/forum
Location: Austin, Tx
nateleavitt wrote:
ok guys...

I removed the bind-address and it's now open! I just added the following rule to only open port 3306 for the local network interface:

Code:
-A INPUT -i eth1 -p tcp -m tcp --dport 3306 -j ACCEPT


Thanks for the suggestions guys!


glad you got it working, however just because you have restricted traffic to the internal network within the data center does not mean you are safe. I would still suggest limiting your firewall down to the specific ip address of your other server.

for example:
Code:
-A INPUT -p TCP -s xx.xx.xx.xx --destination-port 3306 -j ACCEPT
Top
   
Reply with quote  
Display posts from previous:  Sort by  
Post new topic  Reply to topic

Board index » Linux Community Forums » Linux Networking


Who is online

Users browsing this forum: No registered users and 1 guest

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  
RSS

Powered by phpBB® Forum Software © phpBB Group