使用 IPTABLES 将 MySQL 3306 端口限制为本地主机
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/11001368/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Restricting MySQL 3306 port to localhost with IPTABLES
提问by califmerchant
I am trying to restrict MySQL 3306 port on a linux machine from making any connections to anything other than localhost to prevent outside attacks. i have the following code, i am not sure if it's correct:
我试图限制 Linux 机器上的 MySQL 3306 端口与本地主机以外的任何东西建立任何连接，以防止外部攻击。我有以下代码，我不确定它是否正确：
iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT iptables -A OUTPUT -p tcp -s localhost --dport 3306 -j ACCEPT iptables -A INPUT -p tcp --dport 3306 -j DROP iptables -A OUTPUT -p tcp --dport 3306 -j DROP
iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT iptables -A OUTPUT -p tcp -s localhost --dport 3306 -j ACCEPT iptables -A INPUT -p tcp --dport 3306 -j DROP iptables -A OUTPUT -p tcp --dport 3306 -j DROP
my other question is - is it correct to only give localhost access? this is a standard dedicated centos webserver with more than 30 domains on it.
我的另一个问题是 - 只授予本地主机访问权限是否正确？这是一个标准的专用 centos 网络服务器，上面有 30 多个域。
回答by Will Morgan
Why not just turn off networking with MySQL?
为什么不直接关闭与 MySQL 的网络？
Add to my.cnf:
添加到我的.cnf：
skip-networking
skip-networking
It's supposed to also give a negligible performance improvement by forcing connection through pipes, which skips over lots of tests used for the networking section. Please note you will need to use localhost, not127.0.0.1, after the change.
它还应该通过强制通过管道进行连接来提供可以忽略不计的性能改进，这会跳过用于网络部分的大量测试。请注意，更改后您将需要使用 localhost，而不是127.0.0.1。
回答by Nikunj MAster
iptables -A INPUT -p tcp --dport 3306 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
The above rule is for converting two lines into single one.
上述规则用于将两行转换为一行。
Answer to your second question:
回答你的第二个问题：
If you do not want to provide mysql access from other than localhost, then it is perfect to configure this way. Simple. :-)
如果你不想提供来自 localhost 以外的 mysql 访问，那么这样配置是完美的。简单的。:-)
回答by KKKas
iptables -A INPUT -p tcp --dport 3306 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
If you want to remove the filtering, use this:
如果要删除过滤，请使用以下命令：
iptables -D INPUT -p tcp --dport 3306 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -D INPUT -p tcp --dport 3306 -j DROP
Note: Both might require root, so: sudo iptables (...)
注意：两者都可能需要 root，所以：sudo iptables (...)
