Hello,
Andy B. a écrit :
Webserver that uses many many mySQL connections to 127.0.0.1 (Port 3306).
Now I would like to put the mySQL server onto a dedicated machine without
changing the "127.0.0.1" setting on a few hundred websites.
The new mySQL Server listens on 10.0.0.100:3306
My first guess was the following ruleset on the webserver:
iptables -t nat -A PREROUTING -p tcp -i lo --dport 3306 -j DNAT --to
10.0.0.100
Then I tried to telnet 127.0.0.1 3306, which failed immediately
Of course. Locally generated packets don't go into the PREROUTING chain.
I figured out the prerouting is no good for localhost and changed it into:
iptables -t nat -A OUTPUT -o lo -p tcp --dport 3306 -j DNAT --to
10.0.0.100:3306
telnet 127.0.0.1 3306 seems to do something, but not what I expected:
$ telnet 127.0.0.1 3333
Why 3333 ?
Trying 127.0.0.1...
<sleeping...... sleeping......>
Timeout eventually.
Does connecting directly to the SQL server work (no filtering rule that
may block the connection) ?
What is the kernel version ? Since 2.6.11, DNAT in the OUTPUT chain does
not mangle the source address any more. But 127.0.0.1 is an invalid
address for external communication and is rejected by the re-routing
decision.
|