From: "adburne" <adburne@asocmedrosario.com.ar>
To: netfilter@lists.netfilter.org
Subject: NAT & MySQL
Date: Tue, 25 Nov 2003 09:17:32 -0300 [thread overview]
Message-ID: <3FC3485C.000009.00204@adburne> (raw)
[-- Attachment #1.1: Type: Text/Plain, Size: 2201 bytes --]
Someone can make NAT with mysql? I've tried for a long time without make it
work.
My natural language is spanish, sorry by mistakes writing in english.
This is the situation:
I've have a linux box as gateway between my lan and internet routing paquets
without problems, I need access from internet another linux box running
apache and mysql on my private lan.
To do this work I try to use nat; with apache all works ok, but with mysql
can't connect. I'll be looking on different network devices using tcpdump to
find what's wrong.
This is what tcpdump show on device eth0 on my mysql server (inside the lan)
there is a petition from 200.10.10.1 (internet client) to 192.168.0.80
(mysql lan server), this reply with ack, but internet client don't
reply. Any clue? =)
200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0) win 5840
<mss
1412,sackOK,timestamp 620645629 0,nop,wscale 0> (DF)
192.168.0.80.3306 > 200.10.10.1.56405: S 2497023396:2497023396(0) ack
2205542766
win 5792 <mss 1460,sackOK,timestamp 95764658 620645629,nop,wscale 0> (DF)
200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766(0) win 0 (DF)
200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0) win 5840
<mss
1412,sackOK,timestamp 620648701 0,nop,wscale 0> (DF)
192.168.0.80.3306 > 200.10.10.1.56405: S 2503023731:2503023731(0) ack
2205542766
win 5792 <mss 1460,sackOK,timestamp 95765258 620648701,nop,wscale 0> (DF)
200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766(0) win 0 (DF)
The forward rules on the gateway are:
# "Accept forward all connections to port 3306 on ppp0"
iptables -A FORWARD -p tcp -i ppp0 --dport 3306 -o eth0 -j ACCEPT
# "All stablished connections are ok"
iptables -A FORWARD -i ppp0 -o eth0 -m state --state ESTABLISHED,RELATED -j
ACCEPT
# "All connection from inside to outside are accepted"
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
# "Rest go away"
iptables -A FORWARD -j REJECT
NAT rule:
iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 3306 -j DNAT --to 192
168.0.80 -s 200.10.10.1
If someone can make the light turn on, thanks!!!!
Alejandro
[-- Attachment #1.2: Type: Text/HTML, Size: 4274 bytes --]
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="IncrediMail 1.0" name=GENERATOR>
<!--IncrdiXMLRemarkStart>
<IncrdiX-Info>
<X-FID>FLAVOR00-NONE-0000-0000-000000000000</X-FID>
<X-FVER>3.0</X-FVER>
<X-CNT>;</X-CNT>
</IncrdiX-Info>
<IncrdiXMLRemarkEnd-->
</HEAD>
<BODY style="BACKGROUND-POSITION: 0px 0px; FONT-SIZE: 12pt; MARGIN: 5px 10px 10px; FONT-FAMILY: Arial" bgColor=#ffffff background="" scroll=yes ORGYPOS="0" X-FVER="3.0">
<TABLE id=INCREDIMAINTABLE cellSpacing=0 cellPadding=2 width="100%" border=0>
<TBODY>
<TR>
<TD id=INCREDITEXTREGION style="FONT-SIZE: 12pt; CURSOR: auto; FONT-FAMILY: Arial" width="100%">
<DIV>Someone can make NAT with mysql? I've tried for a long time without make it work.</DIV>
<DIV> </DIV>
<DIV>My natural language is spanish, sorry by mistakes writing in english.</DIV>
<DIV> </DIV>
<DIV>This is the situation:</DIV>
<DIV> </DIV>
<DIV>I've have a linux box as gateway between my lan and internet routing paquets without problems, I need access from internet another linux box running apache and mysql on my private lan.</DIV>
<DIV>To do this work I try to use nat; with apache all works ok, but with mysql can't connect. I'll be looking on different network devices using tcpdump to find what's wrong.</DIV>
<DIV> </DIV>
<DIV>This is what tcpdump show on device eth0 on my mysql server (inside the lan), there is a petition from 200.10.10.1 (internet client) to 192.168.0.80 (mysql lan server), this reply with ack, but internet client don't </DIV>
<DIV>reply. Any clue? =)</DIV>
<DIV> </DIV>
<DIV>200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0) win 5840 <mss<BR>1412,sackOK,timestamp 620645629 0,nop,wscale 0> (DF)<BR>192.168.0.80.3306 > 200.10.10.1.56405: S 2497023396:2497023396(0) ack 2205542766<BR> win 5792 <mss 1460,sackOK,timestamp 95764658 620645629,nop,wscale 0> (DF)<BR>200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766(0) win 0 (DF)<BR>200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0) win 5840 <mss<BR>1412,sackOK,timestamp 620648701 0,nop,wscale 0> (DF)<BR>192.168.0.80.3306 > 200.10.10.1.56405: S 2503023731:2503023731(0) ack 2205542766<BR> win 5792 <mss 1460,sackOK,timestamp 95765258 620648701,nop,wscale 0> (DF)<BR>200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766(0) win 0 (DF)<BR></DIV>
<DIV> </DIV>
<DIV>The forward rules on the gateway are:</DIV>
<DIV> </DIV>
<DIV>
<DIV># "Accept forward all connections to port 3306 on ppp0"<BR>iptables -A FORWARD -p tcp -i ppp0 --dport 3306 -o eth0 -j ACCEPT</DIV>
<DIV># "All stablished connections are ok"<BR>iptables -A FORWARD -i ppp0 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT<BR># "All connection from inside to outside are accepted"<BR>iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT</DIV>
<DIV># "Rest go away"</DIV>
<DIV>iptables -A FORWARD -j REJECT</DIV>
<DIV> </DIV>
<DIV>NAT rule:</DIV>
<DIV>iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 3306 -j DNAT --to 192.168.0.80 -s 200.10.10.1</DIV>
<DIV> </DIV>
<DIV>If someone can make the light turn on, thanks!!!!</DIV>
<DIV> </DIV>
<DIV>Alejandro</DIV>
<DIV> </DIV></DIV></TD></TR>
<TR>
<TD id=INCREDIFOOTER width="100%">
<TABLE cellSpacing=0 cellPadding=0 width="100%">
<TBODY>
<TR>
<TD width="100%"></TD>
<TD id=INCREDISOUND vAlign=bottom align=middle></TD>
<TD id=INCREDIANIM vAlign=bottom align=middle></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE><SPAN id=IncrediStamp><SPAN dir=ltr><FONT face="Arial, Helvetica, sans-serif" size=2>_________________________________________________________________<BR><FONT face="Comic Sans MS" size=2><A href="http://www.incredimail.com/redir.asp?ad_id=310&lang=10"><IMG alt="" hspace=0 src="cid:0E1EA367-1F3C-11D8-B817-00805F579555" align=baseline border=0></A> <I>IncrediMail</I> - <B>El E-mail ha evolucionado finalmente</B> - </FONT><A href="http://www.incredimail.com/redir.asp?ad_id=310&lang=10"><FONT face="Times New Roman" size=3><B><U>Haga clic aquí</U></B></FONT></A></SPAN></SPAN></FONT></BODY></HTML>
[-- Attachment #2: IMSTP.gif --]
[-- Type: image/gif, Size: 494 bytes --]
next reply other threads:[~2003-11-25 12:17 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-11-25 12:17 adburne [this message]
2003-11-25 17:19 ` NAT & MySQL Jeffrey Laramie
2003-11-25 19:23 ` Mark E. Donaldson
2003-11-25 21:24 ` Jeffrey Laramie
2003-11-26 2:56 ` Mark E. Donaldson
2003-11-26 3:38 ` Jeffrey Laramie
2003-11-27 14:50 ` adburne
[not found] <3FC4EDAA.6080009@Loudoun-Fairfax.com>
2003-11-27 12:22 ` Alejandro D. Burne
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3FC3485C.000009.00204@adburne \
--to=adburne@asocmedrosario.com.ar \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.