Hello, Andy B. a écrit :
Webserver that uses many many mySQL connections to 127.0.0.1 (Port 3306). Now I would like to put the mySQL server onto a dedicated machine without changing the "127.0.0.1" setting on a few hundred websites. The new mySQL Server listens on 10.0.0.100:3306 My first guess was the following ruleset on the webserver: iptables -t nat -A PREROUTING -p tcp -i lo --dport 3306 -j DNAT --to 10.0.0.100 Then I tried to telnet 127.0.0.1 3306, which failed immediately
Of course. Locally generated packets don't go into the PREROUTING chain.
I figured out the prerouting is no good for localhost and changed it into: iptables -t nat -A OUTPUT -o lo -p tcp --dport 3306 -j DNAT --to 10.0.0.100:3306 telnet 127.0.0.1 3306 seems to do something, but not what I expected: $ telnet 127.0.0.1 3333
Why 3333 ?
Trying 127.0.0.1... <sleeping...... sleeping......> Timeout eventually.
Does connecting directly to the SQL server work (no filtering rule that may block the connection) ? What is the kernel version ? Since 2.6.11, DNAT in the OUTPUT chain does not mangle the source address any more. But 127.0.0.1 is an invalid address for external communication and is rejected by the re-routing decision.
