From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Alejandro D. Burne" Subject: NAT & MySQL Date: Thu, 27 Nov 2003 09:22:18 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3FC5EC7A.000001.00196@adburne> References: <3FC4EDAA.6080009@Loudoun-Fairfax.com> Mime-Version: 1.0 Content-Type: Multipart/related; type="multipart/alternative"; boundary="------------Boundary-00=_6PF0QL80000000000000" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org --------------Boundary-00=_6PF0QL80000000000000 Content-Type: Multipart/Alternative; boundary="------------Boundary-00=_6PF0LVC0000000000000" --------------Boundary-00=_6PF0LVC0000000000000 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable This is the schema:=0D =0D [internet]<-->[ppp0 (dynamic address) - Gateway - 192.168.1.122]<-->[192.= 168 1.252 - MySQL Server]=0D =0D and this is the script:=0D =0D #Setting the EXTERNAL and INTERNAL interfaces for the network=0D EXTIF=3D"ppp0"=0D INTIF=3D"eth0"=0D =0D # Determine the external IP automatically:=0D EXTIP=3D"`$IFCONFIG $EXTIF | $AWK \=0D /$EXTIF/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"=0D =0D # Assign the internal TCP/IP network and IP address=0D INTNET=3D"192.168.1.0/24"=0D INTIP=3D"192.168.1.122/32"=0D =0D # Setting a few other local variables=0D UNIVERSE=3D"0.0.0.0/0"=0D =0D echo " - Verifying that all kernel modules are ok"=0D [... to be more small I supress many lines here...]=0D =0D echo " Enabling forwarding.."=0D echo "1" > /proc/sys/net/ipv4/ip_forward=0D echo " Enabling DynamicAddr.."=0D echo "1" > /proc/sys/net/ipv4/ip_dynaddr=0D =0D echo " Clearing any existing rules.."=0D $IPTABLES -P INPUT ACCEPT=0D $IPTABLES -F INPUT =0D $IPTABLES -P OUTPUT ACCEPT=0D $IPTABLES -F OUTPUT =0D $IPTABLES -P FORWARD DROP=0D $IPTABLES -F FORWARD =0D $IPTABLES -F -t nat=0D # Flush the user chain.. if it exists=0D if [ -n "`$IPTABLES -L | $GREP drop-and-log-it`" ]; then=0D $IPTABLES -F drop-and-log-it=0D fi=0D # Delete all User-specified chains=0D $IPTABLES -X=0D # Reset all IPTABLES counters=0D $IPTABLES -Z=0D =0D echo " Creating a DROP chain.."=0D $IPTABLES -N drop-and-log-it=0D $IPTABLES -A drop-and-log-it -j LOG --log-level info =0D $IPTABLES -A drop-and-log-it -j REJECT=0D =0D echo -e " - Loading FORWARD rulesets"=0D $IPTABLES -A FORWARD -i $EXTIF -p tcp --dport 3306 -o $INTIF -j ACCEPT=0D $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED RELATED \=0D -j ACCEPT=0D $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT=0D # Catch all rule, all other forwarding is denied and logged. =0D $IPTABLES -A FORWARD -j drop-and-log-it=0D =0D =0D echo " - NAT: Enabling SNAT functionality on $EXTIF"=0D $IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 3306 -j DNAT --to 192.168.1.252:3306=0D $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP=0D =0D Alejandro --------------Boundary-00=_6PF0LVC0000000000000 Content-Type: Text/HTML; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

This is the schema:

[internet]<-->[ppp0 (dynamic address) - Gateway - 192.168= =2E1.122]<-->[192.168.1.252 - MySQL Server]

and this is the script:

#Setting the EXTERNAL and INTERNAL interfaces for the network
EXT= IF=3D"ppp0"
INTIF=3D"eth0"

# Determine the external IP automatically:
EXTIP=3D"`$IFCONFIG $E= XTIF | $AWK \
/$EXTIF/'{next}//{split($0,a,":");split(a[2],a," "= );print a[1];exit}'`"

# Assign the internal TCP/IP network and IP address
INTNET=3D"192= =2E168.1.0/24"
INTIP=3D"192.168.1.122/32"

# Setting a few other local variables
UNIVERSE=3D"0.0.0.0/0"

echo " - Verifying that all kernel modules are ok"
[... to = be more small I supress many lines here...]

echo " Enabling forwarding.."
echo "1" > /proc/sys/net/i= pv4/ip_forward
echo " Enabling DynamicAddr.."
echo "1" > /= proc/sys/net/ipv4/ip_dynaddr

echo " Clearing any existing rules.."
$IPTABLES -P INPUT AC= CEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F= OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABL= ES -F -t nat
# Flush the user chain.. if it exists
if [ -n "`$IPTAB= LES -L | $GREP drop-and-log-it`" ]; then
$IPTABLES -F dro= p-and-log-it
fi
# Delete all User-specified chains
$IPTABLES -X<= BR># Reset all IPTABLES counters
$IPTABLES -Z

echo " Creating a DROP chain.."
$IPTABLES -N drop-and-log-i= t
$IPTABLES -A drop-and-log-it -j LOG --log-level info
$IPTABLES -= A drop-and-log-it -j REJECT

echo -e " - Loading FORWARD rulesets"
$IPTABLES -A FO= RWARD -i $EXTIF -p tcp --dport 3306 -o $INTIF -j ACCEPT
$IPTABLES -A F= ORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED \
&nbs= p;-j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
# Ca= tch all rule, all other forwarding is denied and logged.
$IPTABLES -A= FORWARD -j drop-and-log-it

echo " - NAT: Enabling SNAT functionalit= y on $EXTIF"
$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 3= 306 -j DNAT --to 192.168.1.252:3306
$IPTABLES -t nat -A POSTROUTING -o= $EXTIF -j SNAT --to $EXTIP

Alejandro

______________________= ___________________________________________

3D""

IncrediMail = - El E-mail ha evolucionado finalmente - Haga clic aqu=ED<= /SPAN> --------------Boundary-00=_6PF0LVC0000000000000-- --------------Boundary-00=_6PF0QL80000000000000 Content-Type: image/gif; name="IMSTP.gif" Content-Transfer-Encoding: base64 Content-ID: <68A9AED4-20D0-11D8-B818-00805F579555> R0lGODlhFAAPALMIAP9gAM9gAM8vAM9gL/+QL5AvAGAvAP9gL////wAAAAAAAAAAAAAAAAAAAAAA AAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQJFAAIACwAAAAAFAAPAAAEVRDJSaudJuudrxlEKI6B URlCUYyjKpgYAKSgOBSCDEuGDKgrAtC3Q/R+hkPJEDgYCjpKr5A8WK9OaPFZwHoPqm3366VKyeRt E30tVVRscMHDqV/u+AgAIfkEBWQACAAsAAAAABQADwAABBIQyUmrvTjrzbv/YCiOZGmeaAQAIfkE CRQACAAsAgABABAADQAABEoQIUOrpXIOwrsPxiQUheeRAgUA49YNhbCqK1kS9grQhXGAhsDBUJgZ AL2Dcqkk7ogFpvRAokSn0p4PO6UIuUsQggSmFjKXdAgRAQAh+QQFCgAIACwAAAAAFAAPAAAEEhDJ Sau9OOvNu/9gKI5kaZ5oBAAh+QQJFAAIACwCAAEAEAANAAAEShAhQ6ulcg7Cuw/GJBSF55ECBQDj 1g2FsKorWRL2CtCFcYCGwMFQmBkAvYNyqSTuiAWm9ECiRKfSng87pQi5SxCCBKYWMpd0CBEBACH5 BAVkAAgALAAAAAAUAA8AAAQSEMlJq7046827/2AojmRpnmgEADs= --------------Boundary-00=_6PF0QL80000000000000--