Re: port forwarding through localhost

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

Andy B. a écrit :

Webserver that uses many many mySQL connections to 127.0.0.1 (Port 3306).

Now I would like to put the mySQL server onto a dedicated machine without
changing the "127.0.0.1" setting on a few hundred websites.

The new mySQL Server listens on 10.0.0.100:3306

My first guess was the following ruleset on the webserver:

iptables -t nat -A PREROUTING -p tcp -i lo --dport 3306 -j DNAT --to
10.0.0.100

Then I tried to telnet 127.0.0.1 3306, which failed immediately

Of course. Locally generated packets don't go into the PREROUTING chain.

I figured out the prerouting is no good for localhost and changed it into:

iptables -t nat -A OUTPUT -o lo -p tcp --dport 3306 -j DNAT --to
10.0.0.100:3306

telnet 127.0.0.1 3306 seems to do something, but not what I expected:

$ telnet 127.0.0.1 3333

Why 3333 ?

Trying 127.0.0.1...

<sleeping...... sleeping......>

Timeout eventually.

Does connecting directly to the SQL server work (no filtering rule that may block the connection) ? What is the kernel version ? Since 2.6.11, DNAT in the OUTPUT chain does not mangle the source address any more. But 127.0.0.1 is an invalid address for external communication and is rejected by the re-routing decision.



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux