iptables 开启3306端口
2024-10-09 06:40:34
[root@mysqld ~]# mysql -uroot -h 192.168.1.35 -p
Enter password:
ERROR 1130 (HY000): Host '192.168.1.66' is not allowed to connect to this MySQL server
下表可见3306端口没打开:
[root@v01-svn-test-server online]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 ACCEPT all -- 127.0.0.1 127.0.0.1
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 Chain FORWARD (policy ACCEPT)
num target prot opt source destination Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 state ESTABLISHED
2 ACCEPT all -- 127.0.0.1 0.0.0.0/0
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80 state ESTABLISHED
[root@v01-svn-test-server online]# iptables -A INPUT -p tcp -s 192.168.1.66 --dport 3306 -j ACCEPT
[root@v01-svn-test-server online]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 ACCEPT all -- 127.0.0.1 127.0.0.1
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
4 ACCEPT tcp -- 192.168.1.66 0.0.0.0/0 tcp dpt:3306 Chain FORWARD (policy ACCEPT)
num target prot opt source destination Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 state ESTABLISHED
2 ACCEPT all -- 127.0.0.1 0.0.0.0/0
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80 state ESTABLISHED
建个远程账户：
mysql> select user,host,password from user;
+------+-----------+-------------------------------------------+
| user | host | password |
+------+-----------+-------------------------------------------+
| root | localhost | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
+------+-----------+-------------------------------------------+
1 row in set (0.06 sec)
mysql> grant select on *.* to "select_user"@"%" identified by "123";
Query OK, 0 rows affected (0.10 sec)
mysql> select user,host,password from user;
+-------------+-----------+-------------------------------------------+
| user | host | password |
+-------------+-----------+-------------------------------------------+
| root | localhost | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
| select_user | % | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
+-------------+-----------+-------------------------------------------+
2 rows in set (0.00 sec)
成功连入远程连入mysql服务器:
[root@mysqld ~]# mysql -uselect_user -h192.168.1.35 -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 13
Server version: 5.5.40-log MySQL Community Server (GPL) Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved. Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql>
关掉3306端口，再次测试:
[root@v01-svn-test-server online]# iptables -D INPUT -p tcp -s 192.168.1.66 --dport 3306 -j ACCEPT
[root@v01-svn-test-server online]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 ACCEPT all -- 127.0.0.1 127.0.0.1
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 Chain FORWARD (policy ACCEPT)
num target prot opt source destination Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 state ESTABLISHED
2 ACCEPT all -- 127.0.0.1 0.0.0.0/0
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80 state ESTABLISHED
[root@v01-svn-test-server online]# iptables -P INPUT DROP
[root@v01-svn-test-server online]# iptables -P OUTPUT DROP
[root@v01-svn-test-server online]# iptables -P FORWARD DROP
[root@v01-svn-test-server online]# service iptables status
Table: filter
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 ACCEPT all -- 127.0.0.1 127.0.0.1
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 Chain FORWARD (policy DROP)
num target prot opt source destination Chain OUTPUT (policy DROP)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 state ESTABLISHED
2 ACCEPT all -- 127.0.0.1 0.0.0.0/0
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80 state ESTABLISHED
[root@mysqld ~]# mysql -uselect_user -h192.168.1.35 -p
Enter password: #卡主无法链接
重新开启3306端口:
[root@v01-svn-test-server online]# service iptables status
Table: filter
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
3 ACCEPT all -- 127.0.0.1 127.0.0.1
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 Chain FORWARD (policy DROP)
num target prot opt source destination Chain OUTPUT (policy DROP)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:3306
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 state ESTABLISHED
3 ACCEPT all -- 127.0.0.1 0.0.0.0/0
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80 state ESTABLISHED [root@v01-svn-test-server online]# cat /etc/sysconfig/ip
ip6tables ip6tables.old iptables-config iptables.save
ip6tables-config iptables iptables.old
[root@v01-svn-test-server online]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Wed Jun 1 22:15:41 2016
*filter
:INPUT DROP [24:3081]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Jun 1 22:15:41 2016
最新文章
- 01.LoT.UI 前后台通用框架分解系列之——小图片背景全屏显示（可自动切换背景）
- μC/OS-Ⅲ系统中的任务种类及基本状态
- ios 设置声音和震动，单独控制
- c++ 中string用c输入输出
- php的字符串处理函数
- LiveUpdate Adminstrator配置手册
- 设计模式之工厂模式(Factory)
- WWDC 2016: Rich Notifications in iOS 10
- SQL Server日期函数总结
- 百度编辑器ueditor如何配置
- JAVA 和 C# 调用外部.exe文件，传值并等等exe完成，获取返回值
- unittest单元测试流程
- stm32之keil开发环境搭建
- ubuntu重复登录问题
- spring+redis的集成，redis做缓存
- HDU 1301-Jungle Roads【Kruscal】模板题
- vue文件中引入外部js
- 20.纯 CSS 为母亲节创作一颗像素画风格的爱心
- Kafka 0.8 NIO通信机制
- RefreshListView中onItemClick点击错位