Restricting MySQL 3306 port to localhost with IPTABLES

mysql iptables
califmerchant picture califmerchant · Jun 12, 2012 · Viewed 28.8k times · Source

I am trying to restrict MySQL 3306 port on a linux machine from making any connections to anything other than localhost to prevent outside attacks. i have the following code, i am not sure if it's correct:

iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT

iptables -A OUTPUT -p tcp -s localhost --dport 3306 -j ACCEPT

iptables -A INPUT -p tcp --dport 3306 -j DROP

iptables -A OUTPUT -p tcp --dport 3306 -j DROP

my other question is - is it correct to only give localhost access? this is a standard dedicated centos webserver with more than 30 domains on it.

Answer

Will Morgan picture Will Morgan · Jun 12, 2012

Why not just turn off networking with MySQL?

Add to my.cnf:

skip-networking

It's supposed to also give a negligible performance improvement by forcing connection through pipes, which skips over lots of tests used for the networking section. Please note you will need to use localhost, not 127.0.0.1, after the change.

Related questions

Trying to connect to remote MySQL host (error 2003)

I have a MySQL instance running on a Debian server and I can connect to it locally with no problems. However, I am unable to connect to it remotely. When I try this from my command line I get the …

Read More
Accessing a mysql database from external host/ip? (ie: mysql workbench)

I have a mysql server running on x.x.x.x, and can access it internally no problem (of course). However when attempting to connect externally, ie using mysql workbench, or even from an external server, I get the error …

Read More
Restricting MySQL 3306 port with IPTABLES

How to block mysql port 3306 for everybody, but allow it for a specific IP? This is what I currently do: iptables -I INPUT 1 -p tcp --dport 3306 -j ACCEPT

Read More