在Debian的iptables中添加规则以打开新端口

Question

I am trying to open port 3306 in iptables in my Debian System to allow access to MySQL server. For which I entered this command:

root@debian:/# sudo iptables -A INPUT -p tcp --dport 3306 ACCEPT
root@debian:/# iptables-save

I entered the new connection and it has been saved in iptables as I can see the new rule in iptables list genereted by iptables-save command.

However, this debian system is running on a VM over Windows7 and I'm not able to telnet from Windows to this port. Not sure where I am supposed to check for the solution to this problem.

Answer 1

About your command line:

root@debian:/# sudo iptables -A INPUT -p tcp --dport 3306 --jump ACCEPT
root@debian:/# iptables-save

• You are already authenticated as root so sudo is redundant there.

• You are missing the -j or --jump just before the ACCEPT parameter (just tought that was a typo and you are inserting it correctly).

About yout question:

If you are inserting the iptables rule correctly as you pointed it in the question, maybe the issue is related to the hypervisor (virtual machine provider) you are using.

If you provide the hypervisor name (VirtualBox, VMWare?) I can further guide you on this but here are some suggestions you can try first:

check your vmachine network settings and:

• if it is set to NAT, then you won't be able to connect from your base machine to the vmachine.

• if it is set to Hosted, you have to configure first its network settings, it is usually to provide them an IP in the range 192.168.56.0/24, since is the default the hypervisors use for this.

• if it is set to Bridge, same as Hosted but you can configure it whenever IP range makes sense for you configuration.

Hope this helps.

Answer 2

(I presume that you've concluded that it's an iptables problem by dropping the firewall completely (iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -F) and confirmed that you can connect to the MySQL server from your Windows box?)

Some previous rule in the INPUT table is probably rejecting or dropping the packet. You can get around that by inserting the new rule at the top, although you might want to review your existing rules to see whether that's sensible:

iptables -I INPUT 1 -p tcp --dport 3306 -j ACCEPT

Note that iptables-save won't save the new rule persistently (ie across reboots) - you'll need to figure out something else for that. My usual route is to store the iptables-save output in a file (/etc/network/iptables.rules or similar) and then load then with a pre-up statement in /etc/network/interfaces).