I've traditionally used SSH tunneling to connect to my remote MySQL server. However, I am enabling replication to a slave instance and so am attempting to get direct connections to port 3306 working from specific external IP addresses.
I have set MySQL to bind to all addresses on the host and verified this working via netstat and also by connecting to it locally using the public IP rather than to localhost or 127.0.0.1. I have also poked holes in the firewall (using ufw) for port 3306/tcp for the specific remote IP addresses of interest (replaced with 22.214.171.124 in the
ufw status verbose output below).
To Action From -- ------ ---- 80,443/tcp (Nginx Full) ALLOW IN Anywhere 25/tcp ALLOW IN Anywhere 143 ALLOW IN Anywhere 110 ALLOW IN Anywhere 993/tcp (Dovecot Secure IMAP) ALLOW IN Anywhere 995/tcp (Dovecot Secure POP3) ALLOW IN Anywhere 25/tcp (Postfix) ALLOW IN Anywhere 465/tcp (Postfix SMTPS) ALLOW IN Anywhere 22 ALLOW IN Anywhere 3306/tcp ALLOW IN 126.96.36.199 80,443/tcp (Nginx Full (v6)) ALLOW IN Anywhere (v6) 25/tcp (v6) ALLOW IN Anywhere (v6) 143 (v6) ALLOW IN Anywhere (v6) 110 (v6) ALLOW IN Anywhere (v6) 993/tcp (Dovecot Secure IMAP (v6)) ALLOW IN Anywhere (v6) 995/tcp (Dovecot Secure POP3 (v6)) ALLOW IN Anywhere (v6) 25/tcp (Postfix (v6)) ALLOW IN Anywhere (v6) 465/tcp (Postfix SMTPS (v6)) ALLOW IN Anywhere (v6) 22 (v6) ALLOW IN Anywhere (v6)
iptables also reports the following:
# iptables -S | grep 3306 -A ufw-user-input -s 188.8.131.52/32 -p tcp -m tcp --dport 3306 -j ACCEPT
However, attempts to connect to it from those addresses are simply timing out. Nothing appears in the ufw, syslog, kernel or mysql error log files when I attempt to connect, so I am stumped at this point. What have I missed?