From: "Alejandro D. Burne" <adburne@amr.org.ar>
To: netfilter@lists.netfilter.org
Subject: NAT & MySQL
Date: Thu, 27 Nov 2003 09:22:18 -0300 [thread overview]
Message-ID: <3FC5EC7A.000001.00196@adburne> (raw)
In-Reply-To: 3FC4EDAA.6080009@Loudoun-Fairfax.com
[-- Attachment #1.1: Type: Text/Plain, Size: 2088 bytes --]
This is the schema:
[internet]<-->[ppp0 (dynamic address) - Gateway - 192.168.1.122]<-->[192.168
1.252 - MySQL Server]
and this is the script:
#Setting the EXTERNAL and INTERNAL interfaces for the network
EXTIF="ppp0"
INTIF="eth0"
# Determine the external IP automatically:
EXTIP="`$IFCONFIG $EXTIF | $AWK \
/$EXTIF/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"
# Assign the internal TCP/IP network and IP address
INTNET="192.168.1.0/24"
INTIP="192.168.1.122/32"
# Setting a few other local variables
UNIVERSE="0.0.0.0/0"
echo " - Verifying that all kernel modules are ok"
[... to be more small I supress many lines here...]
echo " Enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo " Enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo " Clearing any existing rules.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -F -t nat
# Flush the user chain.. if it exists
if [ -n "`$IPTABLES -L | $GREP drop-and-log-it`" ]; then
$IPTABLES -F drop-and-log-it
fi
# Delete all User-specified chains
$IPTABLES -X
# Reset all IPTABLES counters
$IPTABLES -Z
echo " Creating a DROP chain.."
$IPTABLES -N drop-and-log-it
$IPTABLES -A drop-and-log-it -j LOG --log-level info
$IPTABLES -A drop-and-log-it -j REJECT
echo -e " - Loading FORWARD rulesets"
$IPTABLES -A FORWARD -i $EXTIF -p tcp --dport 3306 -o $INTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED
RELATED \
-j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
# Catch all rule, all other forwarding is denied and logged.
$IPTABLES -A FORWARD -j drop-and-log-it
echo " - NAT: Enabling SNAT functionality on $EXTIF"
$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 3306 -j DNAT --to
192.168.1.252:3306
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
Alejandro
[-- Attachment #1.2: Type: Text/HTML, Size: 4157 bytes --]
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="IncrediMail 1.0" name=GENERATOR>
<!--IncrdiXMLRemarkStart>
<IncrdiX-Info>
<X-FID>FLAVOR00-NONE-0000-0000-000000000000</X-FID>
<X-FVER></X-FVER>
<X-CNT>;</X-CNT>
</IncrdiX-Info>
<IncrdiXMLRemarkEnd-->
</HEAD>
<BODY style="BACKGROUND-POSITION: 0px 0px; FONT-SIZE: 12pt; MARGIN: 5px 10px 10px; FONT-FAMILY: Arial" bgColor=#ffffff background="" scroll=yes ORGYPOS="0" X-FVER="3.0">
<TABLE id=INCREDIMAINTABLE cellSpacing=0 cellPadding=2 width="100%" border=0>
<TBODY>
<TR>
<TD id=INCREDITEXTREGION style="FONT-SIZE: 12pt; CURSOR: auto; FONT-FAMILY: Arial" width="100%">
<DIV>This is the schema:</DIV>
<DIV> </DIV>
<DIV>
<DIV>[internet]<-->[ppp0 (dynamic address) - Gateway - 192.168.1.122]<-->[192.168.1.252 - MySQL Server]</DIV></DIV>
<DIV> </DIV>
<DIV>and this is the script:</DIV>
<DIV> </DIV>
<DIV>#Setting the EXTERNAL and INTERNAL interfaces for the network<BR>EXTIF="ppp0"<BR>INTIF="eth0"</DIV>
<DIV> </DIV>
<DIV># Determine the external IP automatically:<BR>EXTIP="`$IFCONFIG $EXTIF | $AWK \<BR> /$EXTIF/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"</DIV>
<DIV> </DIV>
<DIV># Assign the internal TCP/IP network and IP address<BR>INTNET="192.168.1.0/24"<BR>INTIP="192.168.1.122/32"</DIV>
<DIV> </DIV>
<DIV># Setting a few other local variables<BR>UNIVERSE="0.0.0.0/0"</DIV>
<DIV> </DIV>
<DIV>echo " - Verifying that all kernel modules are ok"<BR>[... to be more small I supress many lines here...]</DIV>
<DIV> </DIV>
<DIV>echo " Enabling forwarding.."<BR>echo "1" > /proc/sys/net/ipv4/ip_forward<BR>echo " Enabling DynamicAddr.."<BR>echo "1" > /proc/sys/net/ipv4/ip_dynaddr</DIV>
<DIV> </DIV>
<DIV>echo " Clearing any existing rules.."<BR>$IPTABLES -P INPUT ACCEPT<BR>$IPTABLES -F INPUT <BR>$IPTABLES -P OUTPUT ACCEPT<BR>$IPTABLES -F OUTPUT <BR>$IPTABLES -P FORWARD DROP<BR>$IPTABLES -F FORWARD <BR>$IPTABLES -F -t nat<BR># Flush the user chain.. if it exists<BR>if [ -n "`$IPTABLES -L | $GREP drop-and-log-it`" ]; then<BR> $IPTABLES -F drop-and-log-it<BR>fi<BR># Delete all User-specified chains<BR>$IPTABLES -X<BR># Reset all IPTABLES counters<BR>$IPTABLES -Z</DIV>
<DIV> </DIV>
<DIV>echo " Creating a DROP chain.."<BR>$IPTABLES -N drop-and-log-it<BR>$IPTABLES -A drop-and-log-it -j LOG --log-level info <BR>$IPTABLES -A drop-and-log-it -j REJECT</DIV>
<DIV> </DIV>
<DIV>echo -e " - Loading FORWARD rulesets"<BR>$IPTABLES -A FORWARD -i $EXTIF -p tcp --dport 3306 -o $INTIF -j ACCEPT<BR>$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED \<BR> -j ACCEPT<BR>$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT<BR># Catch all rule, all other forwarding is denied and logged. <BR>$IPTABLES -A FORWARD -j drop-and-log-it</DIV>
<DIV> </DIV>
<DIV><BR>echo " - NAT: Enabling SNAT functionality on $EXTIF"<BR>$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 3306 -j DNAT --to 192.168.1.252:3306<BR>$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP<BR></DIV>
<DIV>Alejandro</DIV></TD></TR>
<TR>
<TD id=INCREDIFOOTER width="100%">
<TABLE cellSpacing=0 cellPadding=0 width="100%">
<TBODY>
<TR>
<TD width="100%"></TD>
<TD id=INCREDISOUND vAlign=bottom align=middle></TD>
<TD id=INCREDIANIM vAlign=bottom align=middle></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE><SPAN id=IncrediStamp><SPAN dir=ltr><FONT face="Arial, Helvetica, sans-serif" size=2>_________________________________________________________________<BR><FONT face="Comic Sans MS" size=2><A href="http://www.incredimail.com/redir.asp?ad_id=310&lang=10"><IMG alt="" hspace=0 src="cid:68A9AED4-20D0-11D8-B818-00805F579555" align=baseline border=0></A> <I>IncrediMail</I> - <B>El E-mail ha evolucionado finalmente</B> - </FONT><A href="http://www.incredimail.com/redir.asp?ad_id=310&lang=10"><FONT face="Times New Roman" size=3><B><U>Haga clic aquí</U></B></FONT></A></SPAN></SPAN></FONT></BODY></HTML>
[-- Attachment #2: IMSTP.gif --]
[-- Type: image/gif, Size: 494 bytes --]
next parent reply other threads:[~2003-11-27 12:22 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <3FC4EDAA.6080009@Loudoun-Fairfax.com>
2003-11-27 12:22 ` Alejandro D. Burne [this message]
2003-11-25 12:17 NAT & MySQL adburne
2003-11-25 17:19 ` Jeffrey Laramie
2003-11-25 19:23 ` Mark E. Donaldson
2003-11-25 21:24 ` Jeffrey Laramie
2003-11-26 2:56 ` Mark E. Donaldson
2003-11-26 3:38 ` Jeffrey Laramie
2003-11-27 14:50 ` adburne
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3FC5EC7A.000001.00196@adburne \
--to=adburne@amr.org.ar \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.