0

I've traditionally used SSH tunneling to connect to my remote MySQL server. However, I am enabling replication to a slave instance and so am attempting to get direct connections to port 3306 working from specific external IP addresses.

I have set MySQL to bind to all addresses on the host and verified this working via netstat and also by connecting to it locally using the public IP rather than to localhost or 127.0.0.1. I have also poked holes in the firewall (using ufw) for port 3306/tcp for the specific remote IP addresses of interest (replaced with 1.2.3.4 in the ufw status verbose output below).

To                         Action      From
--                         ------      ----
80,443/tcp (Nginx Full)    ALLOW IN    Anywhere
25/tcp                     ALLOW IN    Anywhere
143                        ALLOW IN    Anywhere
110                        ALLOW IN    Anywhere
993/tcp (Dovecot Secure IMAP) ALLOW IN    Anywhere
995/tcp (Dovecot Secure POP3) ALLOW IN    Anywhere
25/tcp (Postfix)           ALLOW IN    Anywhere
465/tcp (Postfix SMTPS)    ALLOW IN    Anywhere
22                         ALLOW IN    Anywhere
3306/tcp                   ALLOW IN    1.2.3.4
80,443/tcp (Nginx Full (v6)) ALLOW IN    Anywhere (v6)
25/tcp (v6)                ALLOW IN    Anywhere (v6)
143 (v6)                   ALLOW IN    Anywhere (v6)
110 (v6)                   ALLOW IN    Anywhere (v6)
993/tcp (Dovecot Secure IMAP (v6)) ALLOW IN    Anywhere (v6)
995/tcp (Dovecot Secure POP3 (v6)) ALLOW IN    Anywhere (v6)
25/tcp (Postfix (v6))      ALLOW IN    Anywhere (v6)
465/tcp (Postfix SMTPS (v6)) ALLOW IN    Anywhere (v6)
22 (v6)                    ALLOW IN    Anywhere (v6)

iptables also reports the following:

# iptables -S | grep 3306
-A ufw-user-input -s 1.2.3.4/32 -p tcp -m tcp --dport 3306 -j ACCEPT

However, attempts to connect to it from those addresses are simply timing out. Nothing appears in the ufw, syslog, kernel or mysql error log files when I attempt to connect, so I am stumped at this point. What have I missed?

0

It turns out I had everything done correctly. What I missed was the cloud firewall on top of my VPS, imposed by my hosting provider. Fortunately, I have control over this through the cloud control panel they supply, so I was able to add port 3306 into that and all fell into place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.