From: "Alejandro D. Burne" <adburne@amr.org.ar>
To: netfilter@lists.netfilter.org
Subject: NAT & MySQL
Date: Thu, 27 Nov 2003 09:22:18 -0300 [thread overview]
Message-ID: <3FC5EC7A.000001.00196@adburne> (raw)
In-Reply-To: 3FC4EDAA.6080009@Loudoun-Fairfax.com
[-- Attachment #1.1: Type: Text/Plain, Size: 2088 bytes --]
This is the schema:
[internet]<-->[ppp0 (dynamic address) - Gateway - 192.168.1.122]<-->[192.168
1.252 - MySQL Server]
and this is the script:
#Setting the EXTERNAL and INTERNAL interfaces for the network
EXTIF="ppp0"
INTIF="eth0"
# Determine the external IP automatically:
EXTIP="`$IFCONFIG $EXTIF | $AWK \
/$EXTIF/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"
# Assign the internal TCP/IP network and IP address
INTNET="192.168.1.0/24"
INTIP="192.168.1.122/32"
# Setting a few other local variables
UNIVERSE="0.0.0.0/0"
echo " - Verifying that all kernel modules are ok"
[... to be more small I supress many lines here...]
echo " Enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo " Enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo " Clearing any existing rules.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -F -t nat
# Flush the user chain.. if it exists
if [ -n "`$IPTABLES -L | $GREP drop-and-log-it`" ]; then
$IPTABLES -F drop-and-log-it
fi
# Delete all User-specified chains
$IPTABLES -X
# Reset all IPTABLES counters
$IPTABLES -Z
echo " Creating a DROP chain.."
$IPTABLES -N drop-and-log-it
$IPTABLES -A drop-and-log-it -j LOG --log-level info
$IPTABLES -A drop-and-log-it -j REJECT
echo -e " - Loading FORWARD rulesets"
$IPTABLES -A FORWARD -i $EXTIF -p tcp --dport 3306 -o $INTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED
RELATED \
-j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
# Catch all rule, all other forwarding is denied and logged.
$IPTABLES -A FORWARD -j drop-and-log-it
echo " - NAT: Enabling SNAT functionality on $EXTIF"
$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 3306 -j DNAT --to
192.168.1.252:3306
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
Alejandro
[-- Attachment #1.2: Type: Text/HTML, Size: 4157 bytes --]
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="IncrediMail 1.0" name=GENERATOR>
<!--IncrdiXMLRemarkStart>
<IncrdiX-Info>
<X-FID>FLAVOR00-NONE-0000-0000-000000000000</X-FID>
<X-FVER></X-FVER>
<X-CNT>;</X-CNT>
</IncrdiX-Info>
<IncrdiXMLRemarkEnd-->
</HEAD>
<BODY style="BACKGROUND-POSITION: 0px 0px; FONT-SIZE: 12pt; MARGIN: 5px 10px 10px; FONT-FAMILY: Arial" bgColor=#ffffff background="" scroll=yes ORGYPOS="0" X-FVER="3.0">
<TABLE id=INCREDIMAINTABLE cellSpacing=0 cellPadding=2 width="100%" border=0>
<TBODY>
<TR>
<TD id=INCREDITEXTREGION style="FONT-SIZE: 12pt; CURSOR: auto; FONT-FAMILY: Arial" width="100%">
<DIV>This is the schema:</DIV>
<DIV> </DIV>
<DIV>
<DIV>[internet]<-->[ppp0 (dynamic address) - Gateway - 192.168.1.122]<-->[192.168.1.252 - MySQL Server]</DIV></DIV>
<DIV> </DIV>
<DIV>and this is the script:</DIV>
<DIV> </DIV>
<DIV>#Setting the EXTERNAL and INTERNAL interfaces for the network<BR>EXTIF="ppp0"<BR>INTIF="eth0"</DIV>
<DIV> </DIV>
<DIV># Determine the external IP automatically:<BR>EXTIP="`$IFCONFIG $EXTIF | $AWK \<BR> /$EXTIF/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"</DIV>
<DIV> </DIV>
<DIV># Assign the internal TCP/IP network and IP address<BR>INTNET="192.168.1.0/24"<BR>INTIP="192.168.1.122/32"</DIV>
<DIV> </DIV>
<DIV># Setting a few other local variables<BR>UNIVERSE="0.0.0.0/0"</DIV>
<DIV> </DIV>
<DIV>echo " - Verifying that all kernel modules are ok"<BR>[... to be more small I supress many lines here...]</DIV>
<DIV> </DIV>
<DIV>echo " Enabling forwarding.."<BR>echo "1" > /proc/sys/net/ipv4/ip_forward<BR>echo " Enabling DynamicAddr.."<BR>echo "1" > /proc/sys/net/ipv4/ip_dynaddr</DIV>
<DIV> </DIV>
<DIV>echo " Clearing any existing rules.."<BR>$IPTABLES -P INPUT ACCEPT<BR>$IPTABLES -F INPUT <BR>$IPTABLES -P OUTPUT ACCEPT<BR>$IPTABLES -F OUTPUT <BR>$IPTABLES -P FORWARD DROP<BR>$IPTABLES -F FORWARD <BR>$IPTABLES -F -t nat<BR># Flush the user chain.. if it exists<BR>if [ -n "`$IPTABLES -L | $GREP drop-and-log-it`" ]; then<BR> $IPTABLES -F drop-and-log-it<BR>fi<BR># Delete all User-specified chains<BR>$IPTABLES -X<BR># Reset all IPTABLES counters<BR>$IPTABLES -Z</DIV>
<DIV> </DIV>
<DIV>echo " Creating a DROP chain.."<BR>$IPTABLES -N drop-and-log-it<BR>$IPTABLES -A drop-and-log-it -j LOG --log-level info <BR>$IPTABLES -A drop-and-log-it -j REJECT</DIV>
<DIV> </DIV>
<DIV>echo -e " - Loading FORWARD rulesets"<BR>$IPTABLES -A FORWARD -i $EXTIF -p tcp --dport 3306 -o $INTIF -j ACCEPT<BR>$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED \<BR> -j ACCEPT<BR>$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT<BR># Catch all rule, all other forwarding is denied and logged. <BR>$IPTABLES -A FORWARD -j drop-and-log-it</DIV>
<DIV> </DIV>
<DIV><BR>echo " - NAT: Enabling SNAT functionality on $EXTIF"<BR>$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 3306 -j DNAT --to 192.168.1.252:3306<BR>$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP<BR></DIV>
<DIV>Alejandro</DIV></TD></TR>
<TR>
<TD id=INCREDIFOOTER width="100%">
<TABLE cellSpacing=0 cellPadding=0 width="100%">
<TBODY>
<TR>
<TD width="100%"></TD>
<TD id=INCREDISOUND vAlign=bottom align=middle></TD>
<TD id=INCREDIANIM vAlign=bottom align=middle></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE><SPAN id=IncrediStamp><SPAN dir=ltr><FONT face="Arial, Helvetica, sans-serif" size=2>_________________________________________________________________<BR><FONT face="Comic Sans MS" size=2><A href="http://www.incredimail.com/redir.asp?ad_id=310&lang=10"><IMG alt="" hspace=0 src="cid:68A9AED4-20D0-11D8-B818-00805F579555" align=baseline border=0></A> <I>IncrediMail</I> - <B>El E-mail ha evolucionado finalmente</B> - </FONT><A href="http://www.incredimail.com/redir.asp?ad_id=310&lang=10"><FONT face="Times New Roman" size=3><B><U>Haga clic aquí</U></B></FONT></A></SPAN></SPAN></FONT></BODY></HTML>
[-- Attachment #2: IMSTP.gif --]
[-- Type: image/gif, Size: 494 bytes --]
next parent reply other threads:[~2003-11-27 12:22 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <3FC4EDAA.6080009@Loudoun-Fairfax.com>
2003-11-27 12:22 ` Alejandro D. Burne [this message]
2003-11-25 12:17 NAT & MySQL adburne
2003-11-25 17:19 ` Jeffrey Laramie
2003-11-25 19:23 ` Mark E. Donaldson
2003-11-25 21:24 ` Jeffrey Laramie
2003-11-26 2:56 ` Mark E. Donaldson
2003-11-26 3:38 ` Jeffrey Laramie
2003-11-27 14:50 ` adburne
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3FC5EC7A.000001.00196@adburne \
--to=adburne@amr.org.ar \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox