Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just want to be able to access mysql through ssh, but I don't want to accept everything as well. What's the most secure way to do this if any. Here are my rules:


:INPUT DROP [14:1434]

#Input for HTTP
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
#Output for HTTP
-A OUTPUT -o eth0 -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

#Input SSH
-A INPUT -i eth0 -p tcp -m tcp --dport 9991 -m state --state NEW,ESTABLISHED -j ACCEPT
#Output for SSH
-A OUTPUT -o eth0 -p tcp -m tcp --sport 9991 -m state --state ESTABLISHED -j ACCEPT

-A INPUT -i eth0 -p tcp --sport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --sport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT



share|improve this question
Do you want to run an SSH tunnel? I guess what you mean is you don't want to open the default MySQL listening port, which is 3306, or perhaps configure MySQL to listen on a different port and open the firewall for that port? If you want to run a tunnel then you need only the SSH port open and nothing more on the server side (that is, for that sort of connection, I don't mean close HTTP ports etc.). – moon.musick Aug 23 '13 at 16:35
But when I use Sequel Pro to access my databases, the SSH lets me through, but "MySQL said: Can't connect to MySQL server on '' (4)." "ssh -L 3306:localhost:3306 johndoe@" also doesn't work, but "ssh -p 9991 johndoe@" does. If I turn off iptables, both work perfectly. – Maz Aug 23 '13 at 18:10
you normally don't connect to mysql via ssh. you connect via mysql on port 3306. as moon.musick mentioned, you could set up an ssh tunnel. But I think you just want to open port 3306 (copy the lines w 9991 and replace 9991 w 3306) and you'll be happy. – user16081 Aug 23 '13 at 22:05
up vote 4 down vote accepted
iptables -A INPUT -i lo -p tcp --dport 3306 -j ACCEPT 
iptables -A OUTPUT -o lo -p tcp --sport 3306 -j ACCEPT

If you use a tunnel and have INPUT and OUTPUT policies set to DROP, allowing loopback traffic might be a good idea.

share|improve this answer
I added this line to my rules 'code'(-A INPUT -i lo -p tcp --dport 3306 -j ACCEPT and -A OUTPUT -o lo -p tcp --sport 3306 -j ACCEPT) First with just the input, and then with the output as well. Neither helped. I get the same error. Thanks for bearing with me. – Maz Aug 23 '13 at 20:00
Also how do I wrap my code in the 'code' tag. I'm sure my current format is very hard to read. – Maz Aug 23 '13 at 20:05
@Maz if you mean the inline code, just use backticks, like in shell substitution. For block code use 4 space indentation (I guess you figured it out). – moon.musick Aug 23 '13 at 20:14
@Maz Just for clarification - I suppose the MySQL server is indeed running on port 3306? netstat -tlpn should show it. Also, I suppose the port is listed as open if you run nmap -p 3306 localhost? – moon.musick Aug 23 '13 at 20:17
It says that the "Host seems down. If it is really up, but blocking our ping probes, try -PN." This firewall also seems to be blocking repositories because I couldn't install nmap without turning the firewall off first. I'm guessing there's a problem with my firewall setup in general? – Maz Aug 23 '13 at 21:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.