Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I block all traffic for just one port? Take the following situation:

  • Ubuntu Desktop VM
  • Browser has access to internet (port 80 stays open)
  • Ubuntu update services work normally (may not be blocked)
  • MySQL graphical client installed

In a normal setup, the MySQL client can connect to a hosted mysql-server, like with Amazon EC2 because outgoing traffic is allowed.

I have the following setup now. I thought this would block 3306, but I still can make connections with Amazon using the MySQL client. I restarted to be sure all rules were applied.

     To                         Action      From
     --                         ------      ----
[ 1] 22                         ALLOW IN    Anywhere
[ 2] 80                         ALLOW IN    Anywhere
[ 3] 5900                       ALLOW IN    Anywhere
[ 4] Anywhere                   DENY IN     3306
[ 5] 3306                       DENY IN     Anywhere
[ 6] 22                         ALLOW IN    Anywhere (v6)
[ 7] 80                         ALLOW IN    Anywhere (v6)
[ 8] 5900                       ALLOW IN    Anywhere (v6)
[ 9] Anywhere (v6)              DENY IN     3306
[10] 3306                       DENY IN     Anywhere (v6)

Some more explanation...

I use a VM to test an existing web application. I make a copy of the live environment, restore that in the VM. The live application is hosted with Amazon EC2. The database server for the live application is not localhost, but another server. With Amazon, you can use a public address for the connection string, something like Internally, they catch this and an internal IP-address is used. This has the advantage that when an instance crashes, and you need to create another instance with another internal IP-address, the connection string doesn't have to be changed.

This address works from outside AWS, so it works from my VM. I can connect from my VM to the production database. I'm aware of it, and know I should edit the connection string. Sometimes I forget about it and then the production database is used. I prefer to get a big fat ugly error message from my test environment telling me that the database connection has failed. (If somehow another client in the local network would want to connect to the mysql-server in the VM, that's not really a problem.)

So how can I get this working? I thought that blocking port 3306 in the firewall might do the job.

share|improve this question
This is the output of ufw status on which machine, the server ot the client? – MariusMatutiae Nov 21 '13 at 16:59
The Ubuntu desktop VM is the server. For test and development it's just more practical to have the desktop functionality available. The VM acts as webserver for other machines in the same network, like the host. So the UFW output you see here is from the server/desktop. – SPRBRN Nov 21 '13 at 22:15
Change your mysql configuration file to accept connections from localhost only. – Renju Chandran chingath Nov 27 '13 at 13:32
It seems to me that you need DENY OUT or total DENY on 3306. – harrymc Nov 27 '13 at 13:37
@RenjuChandranchingath - I probably haven't explained it properly. The local client (on the VM itself) should not be able to connect to an external mysql-server. I don't care about LAN, but WAN should be blocked. If LAN is blocked as well, to keep is simpler, it's OK. If it's simpler to allow LAN while blocking WAN, that's OK as well. – SPRBRN Nov 27 '13 at 14:35
up vote 1 down vote accepted

As the Ubuntu server is connecting outside to Amazon, setting DENY IN on port 3306 does not stop this connection to the outside.

At the very least you would need to deny outgoing tcp and udp packets on port 3306 :

sudo ufw deny out 3306

But even safer would be to deny all tcp and udp packets on port 3306 :

sudo ufw deny 3306
share|improve this answer
Just did the same for Postgres with 5432. I tried the second rule only, but that is not enough. It seems like that is only for incoming traffic? So I needed the deny out to block outgoing traffic. – SPRBRN Apr 9 '14 at 14:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .