How can I block all traffic for just one port? Take the following situation:
- Ubuntu Desktop VM
- Browser has access to internet (port 80 stays open)
- Ubuntu update services work normally (may not be blocked)
- MySQL graphical client installed
In a normal setup, the MySQL client can connect to a hosted mysql-server, like with Amazon EC2 because outgoing traffic is allowed.
I have the following setup now. I thought this would block 3306, but I still can make connections with Amazon using the MySQL client. I restarted to be sure all rules were applied.
To Action From -- ------ ---- [ 1] 22 ALLOW IN Anywhere [ 2] 80 ALLOW IN Anywhere [ 3] 5900 ALLOW IN Anywhere [ 4] Anywhere DENY IN 3306 [ 5] 3306 DENY IN Anywhere [ 6] 22 ALLOW IN Anywhere (v6) [ 7] 80 ALLOW IN Anywhere (v6) [ 8] 5900 ALLOW IN Anywhere (v6) [ 9] Anywhere (v6) DENY IN 3306  3306 DENY IN Anywhere (v6)
Some more explanation...
I use a VM to test an existing web application. I make a copy of the live environment, restore that in the VM. The live application is hosted with Amazon EC2. The database server for the live application is not localhost, but another server. With Amazon, you can use a public address for the connection string, something like
126.96.36.199.eu-west-1.compute.amazonaws.com. Internally, they catch this and an internal IP-address is used. This has the advantage that when an instance crashes, and you need to create another instance with another internal IP-address, the connection string doesn't have to be changed.
This address works from outside AWS, so it works from my VM. I can connect from my VM to the production database. I'm aware of it, and know I should edit the connection string. Sometimes I forget about it and then the production database is used. I prefer to get a big fat ugly error message from my test environment telling me that the database connection has failed. (If somehow another client in the local network would want to connect to the mysql-server in the VM, that's not really a problem.)
So how can I get this working? I thought that blocking port 3306 in the firewall might do the job.