Firewall policy of Mysql remote access in Centos7

Firewall policy - port access

Setup steps

Detection port

If you cannot connect to Mysql remotely, check whether the default 3306 port allows access:

[root@localhost /]# iptables -L -n|grep 3306
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:3306

allow access to

If not, you need to allow this port access:

[root@localhost /]# iptables -I INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT

Preservation strategy

This is a temporary access permission. You need to save the firewall policy:

[root@localhost /]# iptables-save > iptables.rules

Disable firewall

Because of the change of Centos7, disable firewall:

[root@localhost /]# systemctl stop firewalld.service 
[root@localhost /]# systemctl mask firewalld.service 
Created symlink from /etc/systemd/system/firewalld.service to /dev/null.

Install iptables

To install iptables services:

[root@localhost /]# yum install iptables-services.x86_64 -y
Loaded plugins: fastestmirror, langpacks
base                                                                | 3.6 kB  00:00:00     
extras                                                              | 3.4 kB  00:00:00     
mysql-connectors-community                                          | 2.5 kB  00:00:00     
mysql-tools-community                                               | 2.5 kB  00:00:00     
mysql56-community                                                   | 2.5 kB  00:00:00     
updates                                                             | 3.4 kB  00:00:00     
Loading mirror speeds from cached hostfile
 * base: mirrors.yun-idc.com
 * extras: mirrors.cn99.com
 * updates: mirrors.zju.edu.cn
Resolving Dependencies
--> Running transaction check
---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed
--> Processing Dependency: iptables = 1.4.21-17.el7 for package: iptables-services-1.4.21-17.el7.x86_64
--> Running transaction check
---> Package iptables.x86_64 0:1.4.21-16.el7 will be updated
---> Package iptables.x86_64 0:1.4.21-17.el7 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

===========================================================================================
 Package                     Arch             Version                 Repository      Size
===========================================================================================
Installing:
 iptables-services           x86_64           1.4.21-17.el7           base            50 k
Updating for dependencies:
 iptables                    x86_64           1.4.21-17.el7           base           426 k

Transaction Summary
===========================================================================================
Install  1 Package
Upgrade             ( 1 Dependent package)

Total download size: 476 k
Downloading packages:
No Presto metadata available for base
(1/2): iptables-services-1.4.21-17.el7.x86_64.rpm                   |  50 kB  00:00:00     
(2/2): iptables-1.4.21-17.el7.x86_64.rpm                            | 426 kB  00:00:01     
-------------------------------------------------------------------------------------------
Total                                                      251 kB/s | 476 kB  00:00:01     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Updating   : iptables-1.4.21-17.el7.x86_64                                           1/3 
  Installing : iptables-services-1.4.21-17.el7.x86_64                                  2/3 
  Cleanup    : iptables-1.4.21-16.el7.x86_64                                           3/3 
  Verifying  : iptables-services-1.4.21-17.el7.x86_64                                  1/3 
  Verifying  : iptables-1.4.21-17.el7.x86_64                                           2/3 
  Verifying  : iptables-1.4.21-16.el7.x86_64                                           3/3 

Installed:
  iptables-services.x86_64 0:1.4.21-17.el7                                                 

Dependency Updated:
  iptables.x86_64 0:1.4.21-17.el7                                                          

Complete!

Boot up

After the installation is successful, set the startup:

[root@localhost /]# systemctl enable iptables.service 
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.

Loading strategy

Reload policy:

[root@localhost /]# iptables-restore iptables.rules

Initialization

Policy initialization save:

[root@localhost /]# /usr/libexec/iptables/iptables.init save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

summary

It is divided into two parts, one is to install iptables service, the other is to modify the policy.

Install iptables service

1 disable firewall: systemctl stop firewalld.service / systemctl mask firewalld.service;
2. Install iptables services: Yum install iptables services;
3 startup: systemctl enable iptables.service.

Modification strategy

1 detection port access: iptables-l-n| grep 3306;
2. Access allowed: iptables -I INPUT -p tcp -m state – state NEW -m tcp – dport 3306 -j ACCEPT;
3. Save strategy: iptables save > iptables.rules;
4. Loading strategy: iptables-restore iptables.rules;
5 initialization policy / usr/libexec/iptables/iptables.init save

Tags: iptables firewall MySQL yum

Posted on Fri, 03 Apr 2020 03:22:47 -0700 by jennyp