Home / server / Questions / 821203
In Process
JYelton
Asked: 2016-12-17 10:52:49 +0800 CST

My Ubuntu server sometimes prevents MySQL connections until I restart the networking service, why?

  • 772

I run an instance of MySQL server (5.6), port 3306, on an Ubuntu (14.04 LTS) VM. Employees use a client application to interact with the database.

Periodically, I get a troubleshooting call where the user cannot connect, with the error:

Unable to connect to any of the specified MySQL hosts.

The MySQL error log does not contain a refused or denied connection for the user.

Restarting the machine (not just MySQL) resolves the problem.

I've determined that this appears to be due to client machines being assigned a different IP address. I've also determined that restarting the Ubuntu networking service also resolves the problem.

I am suspicious that there is a network security feature at work here, but I am unable to figure out what it is. I would like to know:

  • Can I disable this "feature" or at least configure it to trust clients on the LAN?
  • Is there a way to view client machines' IP addresses that are being blocked by this mechanism?

Edit:

Firewall setup: ufw is inactive, iptables I believe is "factory default"

networking security ubuntu-14.04

1 Answers

  1. Hmm, most setups I’ve seen use ufw as the default. But that said

    1. Is there a way to view client machines' IP addresses that are being blocked by this mechanism?

    Yes, with ufw, it’s:

        sudo service ufw status

    With iptables it’s:

        sudo iptables -L -v
    1. Can I disable this "feature" or at least configure it to trust clients on the LAN?

    With ufw (assuming your LAN is on 192.168.1.0/24:

        sudo ufw allow all from 192.168.1.0/24 to any port 3306

    With iptables

        sudo iptables -I INPUT 2 -m tcp -p tcp --dport 3306 -s 192.168.1.0/24 -m comment --comment 'Allow all traffic from the local LAN'

    As an aside, in my experience, ubuntu 14.04 has a flaky network stack. On a couple of our servers, the network kept dying and we ended up trashing the machines in favor of centos 7. YMMV.

    • 1