Iptable阻塞mysql端口3306

Question

我让Tomcat服务器运行一个web应用程序，该应用程序必须通过同一台机器上的Hibernate访问mysql服务器。

因此，我在iptables脚本中添加了端口3306的规则，但是tomcat由于某种原因无法连接到mysql服务器。我需要重置所有iptables规则-然后tomcat可以再次连接到mysql服务器。

不过，所有其他iptables规则都能完美地工作。

怎么了？

这是我的剧本：

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp --dport 24 -j ACCEPT

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -p tcp -s localhost --dport 8009 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --dport 8009 -j ACCEPT

iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --dport 3306 -j ACCEPT

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

iptables -A INPUT -p tcp --dport 25 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

iptables -A INPUT -p tcp --dport 587 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT

iptables -A INPUT -p tcp --dport 465 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT

iptables -A INPUT -p tcp --dport 110 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 110 -j ACCEPT

iptables -A INPUT -p tcp --dport 995 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 995 -j ACCEPT

iptables -A INPUT -p tcp --dport 143 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 143 -j ACCEPT

iptables -A INPUT -p tcp --dport 993 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 993 -j ACCEPT

iptables -A INPUT -j DROP

我的/etc/主机文件：

# nameserver config
# IPv4
127.0.0.1 localhost
46.4.7.93 mydomain.com
46.4.7.93 Ubuntu-1004-lucid-64-minimal
46.4.7.93 horst

# IPv6
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

查看iptables日志，给我以下内容：

Jun 22 16:52:43 Ubuntu-1004-lucid-64-minimal kernel: [  435.111780] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52432 DF PROTO=TCP SPT=56108 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:46 Ubuntu-1004-lucid-64-minimal kernel: [  438.110555] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52433 DF PROTO=TCP SPT=56108 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:46 Ubuntu-1004-lucid-64-minimal kernel: [  438.231954] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48020 DF PROTO=TCP SPT=56109 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:49 Ubuntu-1004-lucid-64-minimal kernel: [  441.229778] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48021 DF PROTO=TCP SPT=56109 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:53:57 Ubuntu-1004-lucid-64-minimal kernel: [  508.731839] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=78.92.97.67 DST=46.4.7.93 LEN=64 TOS=0x00 PREC=0x00 TTL=122 ID=23053 DF PROTO=TCP SPT=1672 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0 
Jun 22 16:53:59 Ubuntu-1004-lucid-64-minimal kernel: [  511.625038] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=78.92.97.67 DST=46.4.7.93 LEN=64 TOS=0x00 PREC=0x00 TTL=122 ID=23547 DF PROTO=TCP SPT=1672 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0 
Jun 22 16:54:22 Ubuntu-1004-lucid-64-minimal kernel: [  533.981995] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=27.254.39.16 DST=46.4.7.93 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=6549 PROTO=TCP SPT=6005 DPT=33796 WINDOW=64240 RES=0x00 ACK SYN URGP=0 
Jun 22 16:54:44 Ubuntu-1004-lucid-64-minimal kernel: [  556.297038] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=94.78.93.41 DST=46.4.7.93 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=7712 PROTO=TCP SPT=57598 DPT=445 WINDOW=512 RES=0x00 SYN URGP=0

更新:添加其他日志信息(iptables -L INPUT -v -n和iptables -L OUTPUT -v -n)后，运行脚本后立即获得：

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:24 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0           tcp dpt:8009 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       127.0.0.1            0.0.0.0/0           tcp dpt:3306 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:25 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:587 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:465 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:110 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:995 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:143 state ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:993 state ESTABLISHED 
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            127.0.0.1           tcp dpt:8009 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            127.0.0.1           tcp spt:3306 flags:!0x17/0x02 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:25 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:587 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:465 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:110 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:995 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:143 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:993 

Syslog说：

Jun 22 23:59:16 Ubuntu-1004-lucid-64-minimal kernel: [  546.919862] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=20787 DF PROTO=TCP SPT=60809 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 23:59:19 Ubuntu-1004-lucid-64-minimal kernel: [  549.917002] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=20788 DF PROTO=TCP SPT=60809 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 23:59:19 Ubuntu-1004-lucid-64-minimal kernel: [  550.036103] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=7078 DF PROTO=TCP SPT=60810 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 23:59:22 Ubuntu-1004-lucid-64-minimal kernel: [  553.026132] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=7079 DF PROTO=TCP SPT=60810 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 

Answer 1

这

iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --dport 3306 -j ACCEPT

应该是

iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --sport 3306 ! --syn -j ACCEPT

而不是。您希望您的应答包也返回-这些包将设置为tcp/3306作为源端口。

顺便说一句:为了调试的目的，最好替换掉掉所有通信量的最后一行。

iptables -A INPUT -j DROP

用一些更直观的东西

iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "denied-input "
iptables -A INPUT -j REJECT

在这里，您将发现登录到syslog的丢弃数据包的特性(至少在某种程度上--为了防止打开DoS攻击向量，在本例中，日志记录限制为每分钟10个事件)，以便您可以查找它们。

Answer 2

首先，你能连接到端口吗？类似于：

[rilindo@centos sysconfig]$ telnet 127.0.0.1 3306
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
4
5.0.77-3W@yaYx,sYD)?AhgN2LgConnection closed by foreign host.

另外，您可能需要调整iptables，以便它能够与TCP规则匹配。

iptables -A INPUT -p tcp -m tcp -s 127.0.0.1 --dport 3306 -j ACCEPT

(FWIW，我加载了在我的Ubuntu实例(10.4)上提供的规则集，通过该运行，我可以连接到mySQL)。