원격 MySQL 연결을 허용하도록 서버(CentOS 6.9)를 설정하려고 하는데 방화벽 구성에서 멈췄습니다.
MySQL 측에 모든 것이 올바르게 설정되어 있습니다. iptables를 중지하면 telnet을 통해 연결할 수 있지만 활성 상태일 때는 연결할 수 없습니다.
나는 이미 시도했습니다:
-A INPUT -i lo -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 3306 -j ACCEPT
하지만 여전히 iptables가 활성화되어 있으면 "연결이 거부되었습니다"라는 메시지가 나타납니다. 내가 도대체 뭘 잘못하고있는 겁니까?
편집: iptables -L -x -v -n의 출력
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
11 1122 acctboth all -- * * 0.0.0.0/0 0.0.0.0/0
5 372 tcpchk tcp -- !lo * 0.0.0.0/0 0.0.0.0/0
6 750 udpchk udp -- !lo * 0.0.0.0/0 0.0.0.0/0
0 0 icmpchk icmp -- !lo * 0.0.0.0/0 0.0.0.0/0
11 1122 ipdrop_global all -- * * 0.0.0.0/0 0.0.0.0/0
11 1122 input_custom all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ssh tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22022
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: up to 2/sec burst 10 mode srcip
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 5/min burst 5 LOG flags 0 level 3 prefix `ICMP_DROP '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 4
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 1
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 30
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
0 0 ACCEPT tcp -- * * 103.21.244.0/22 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 103.22.200.0/22 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 103.31.4.0/22 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 104.16.0.0/12 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 108.162.192.0/18 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 131.0.72.0/22 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 141.101.64.0/18 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 162.158.0.0/15 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 172.64.0.0/13 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 173.245.48.0/20 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 188.114.96.0/20 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 190.93.240.0/20 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 197.234.240.0/22 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 198.41.128.0/17 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 216.172.173.146 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 198.1.121.202 0.0.0.0/0 multiport dports 22,80
0 0 ACCEPT icmp -- * * 198.1.121.202 0.0.0.0/0 icmp type 8
0 0 ACCEPT tcp -- * * 184.173.226.84 0.0.0.0/0 multiport dports 22,80
0 0 ACCEPT icmp -- * * 184.173.226.84 0.0.0.0/0 icmp type 8
0 0 ACCEPT tcp -- * * 184.172.224.50 0.0.0.0/0 multiport dports 22,80
0 0 ACCEPT icmp -- * * 184.172.224.50 0.0.0.0/0 icmp type 8
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:26
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:465
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2082
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2083
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2084
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2086
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2087
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2089
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2095
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2096
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:995
0 0 ACCEPT udp -- * * 8.8.4.4 0.0.0.0/0 udp spt:53
0 0 ACCEPT tcp -- * * 8.8.4.4 0.0.0.0/0 tcp spt:53
6 750 ACCEPT udp -- * * 8.8.8.8 0.0.0.0/0 udp spt:53
0 0 ACCEPT tcp -- * * 8.8.8.8 0.0.0.0/0 tcp spt:53
5 372 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22022
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:22022
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `LOG_INPUT: '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- lo * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
0 0 ACCEPT tcp -- eth0 * 216.172.173.146 0.0.0.0/0 tcp dpt:3306
0 0 ACCEPT tcp -- * * 216.172.173.146 0.0.0.0/0 tcp dpt:3306
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 tcpchk tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 udpchk udp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 icmpchk icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
10 866 cpanel-dovecot-solr all -- * * 0.0.0.0/0 0.0.0.0/0
10 866 acctboth all -- * * 0.0.0.0/0 0.0.0.0/0
4 432 tcpchk tcp -- * !lo 0.0.0.0/0 0.0.0.0/0
6 434 udpchk udp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 icmpchk icmp -- * * 0.0.0.0/0 0.0.0.0/0
10 866 output_custom all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 198.1.121.202 icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 184.173.226.84 icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 184.172.224.50 icmp type 0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1129
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1129
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:30000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:30000
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:110
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:43
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:43
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:873
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 owner UID match 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 74.52.223.18 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 74.52.223.66 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 64.5.52.7 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 64.5.52.8 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 64.5.52.9 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 64.5.52.12 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 64.5.52.13 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 64.5.52.14 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 67.18.137.84 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 67.18.137.85 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 67.18.137.86 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 67.18.137.87 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 67.18.137.88 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 74.52.222.226 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 74.52.222.242 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 74.52.223.2 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 owner UID match 47
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 ! owner UID match 0 multiport dports 25,465,587 limit: avg 1/sec burst 5 LOG flags 0 level 5 prefix `OUTBOUND-SMTP : '
6 434 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 ! owner UID match 99
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 ! owner UID match 99
0 0 ACCEPT udp -- * * 0.0.0.0/0 8.8.4.4 udp dpt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 8.8.4.4 tcp dpt:53
0 0 ACCEPT udp -- * * 0.0.0.0/0 8.8.8.8 udp dpt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 8.8.8.8 tcp dpt:53
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 owner UID match 99 limit: avg 20/sec burst 5
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 owner UID match 99 limit: avg 20/sec burst 5
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:465
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2086
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2087
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2089
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:37
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2703
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22
4 432 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22022
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:26
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:110
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:143
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:465
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:587
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2082
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2083
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2084
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2086
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2087
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2089
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2222
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2095
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:2096
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:993
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:995
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `LOG_OUTPUT: '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:3306
Chain acctboth (2 references)
pkts bytes target prot opt in out source destination
Chain cpanel-dovecot-solr (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport sports 8984,7984 owner UID match 490
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport sports 8984,7984 owner UID match 0
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport sports 8984,7984 reject-with icmp-port-unreachable
Chain icmpchk (3 references)
pkts bytes target prot opt in out source destination
Chain input_custom (1 references)
pkts bytes target prot opt in out source destination
Chain ipdrop_global (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 43.255.190.0/23 0.0.0.0/0
Chain output_custom (1 references)
pkts bytes target prot opt in out source destination
Chain ssh (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 67.18.2.226 0.0.0.0/0
0 0 ACCEPT all -- * * 50.23.47.206 0.0.0.0/0
0 0 ACCEPT all -- * * 70.87.80.194 0.0.0.0/0
0 0 ACCEPT all -- * * 216.106.185.169 0.0.0.0/0
0 0 ACCEPT all -- * * 12.96.160.0/24 0.0.0.0/0
0 0 ACCEPT all -- * * 216.19.0.0/24 0.0.0.0/0
0 0 tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW recent: SET name: DEFAULT side: source
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW recent: CHECK seconds: 60 hit_count: 10 name: DEFAULT side: source limit: avg 10/min burst 5 LOG flags 0 level 5 prefix `SSH-ATTACK : '
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW recent: UPDATE seconds: 60 hit_count: 10 name: DEFAULT side: source reject-with tcp-reset
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
Chain tcpchk (3 references)
pkts bytes target prot opt in out source destination
Chain udpchk (3 references)
pkts bytes target prot opt in out source destination
답변1
"-A INPUT -j DROP" 줄이 보이나요? 규칙은 위에서 아래로 읽혀지므로 입력 체인의 트래픽이 mysql 규칙에 도달하기 전에 삭제됩니다. -A는 추가를 의미하므로 그 이후의 모든 규칙은 모든 것을 삭제하는 규칙 뒤에 배치되므로 해당 규칙은 어떤 트래픽과도 일치하지 않습니다.
OUTPUT 체인에도 비슷한 문제가 있습니다. 옵션은 a) 체인에서 -P DROP을 사용하는 것입니다. 그러면 일치하는 다른 항목이 없으면 기본적으로 마지막 작업으로 삭제됩니다(그리고 현재 가지고 있는 규칙을 제거합니다). 또는 b) 해당 규칙을 마지막에 넣어 추가됩니다. 결국. -A 대신 -I를 삽입(규칙을 먼저 배치함)에 사용할 수도 있지만 -A imho와 혼합하는 것은 다소 혼란스럽습니다.