Re: port forwarding through localhost

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Andy B. a écrit :
> 
> Webserver that uses many many mySQL connections to 127.0.0.1 (Port 3306).
> 
> Now I would like to put the mySQL server onto a dedicated machine without
> changing the "127.0.0.1" setting on a few hundred websites.
> 
> The new mySQL Server listens on 10.0.0.100:3306
> 
> My first guess was the following ruleset on the webserver:
> 
> iptables -t nat -A PREROUTING -p tcp -i lo --dport 3306 -j DNAT --to
> 10.0.0.100
> 
> Then I tried to telnet 127.0.0.1 3306, which failed immediately

Of course. Locally generated packets don't go into the PREROUTING chain.

> I figured out the prerouting is no good for localhost and changed it into:
> 
> iptables -t nat -A OUTPUT -o lo -p tcp --dport 3306 -j DNAT --to
> 10.0.0.100:3306
> 
> telnet 127.0.0.1 3306 seems to do something, but not what I expected:
> 
> $ telnet 127.0.0.1 3333

Why 3333 ?

> Trying 127.0.0.1...
> 
> <sleeping...... sleeping......>
> 
> Timeout eventually.

Does connecting directly to the SQL server work (no filtering rule that 
may block the connection) ?
What is the kernel version ? Since 2.6.11, DNAT in the OUTPUT chain does 
not mangle the source address any more. But 127.0.0.1 is an invalid 
address for external communication and is rejected by the re-routing 
decision.