apache / mysql unable to connect jails with PF firewall

Question

I have setup two jail environments on FreeBSD11

root@ns312773:/etc # jls
   JID  IP Address      Hostname                      Path
     1  10.6.6.6        www                           /usr/jails/www
     2  10.6.6.7        dbs                           /usr/jails/dbs

This is what I have in my /etc/pf.conf

### Interfaces ###
 ExtIf ="igb0"
 IntIf ="lo666"

### Hosts ###
 IP_WEB ="192.168.0.1"
 IP_JAIL = "{10.6.6.6, 10.6.6.7, 10.6.6.8, 10.6.6.9}"
 IP_JAIL_WWW = "10.6.6.6"
 IP_JAIL_DBS = "10.6.6.7"
 IP_JAIL_APP = "10.6.6.8"
 NET_JAIL="10.6.6.0/24"

### Ports ###
 PORT_WWW="{80,443}"
 PORT_MYSQL="{3306}"

# WWW
rdr pass on $ExtIf proto tcp from any to $IP_WEB port $PORT_WWW -> $IP_JAIL_WWW
# MYSQL
rdr pass on $ExtIf proto tcp from any to $IP_JAIL_WWW port $PORT_MYSQL -> $IP_JAIL_DBS

when i tried to check if the port is open from $IP_JAIL_WWW

# ezjail-admin console www
Last login: Thu Aug 13 13:30:14 on pts/0
FreeBSD 11.0-CURRENT (GENERIC) #0 r286285: Tue Aug  4 15:12:53 UTC 2015

Welcome to FreeBSD!

Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories:   https://www.FreeBSD.org/security/
FreeBSD Handbook:      https://www.FreeBSD.org/handbook/
FreeBSD FAQ:           https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums:        https://forums.FreeBSD.org/

Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with:  pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.

Show the version of FreeBSD installed:  freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages:  man man
FreeBSD directory layout:      man hier

Edit /etc/motd to change this login announcement.
root@www:~ # telnet 10.6.6.7 3306
Trying 10.6.6.7...
Connected to 10.6.6.7.
Escape character is '^]'.
AHost '10.6.6.6' is not allowed to connect to this MySQL serverConnection closed by foreign host.
root@www:~ #

as far as I can see rdr pass on $ExtIf proto tcp from any to $IP_JAIL_WWW port $PORT_MYSQL -> $IP_JAIL_DBS should pass traffic between the two jails, any advice much appreciated.

score 0 · Accepted Answer · answered Aug 13 '15 at 14:28

I got it, I had to create a MySQL user to be able to connect

mysql> use mysql;
mysql> CREATE USER 'web'@'10.6.6.6' IDENTIFIED BY 'password';
mysql> GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER ON *.* TO 'web'@'10.6.6.6';
mysql> FLUSH PRIVILEGES;

then from the web jail:

# ezjail-admin console www
root@www:~ # vi /usr/local/www/apache24/data/mysql.php

<?php
$servername = "10.6.6.7";
$username = "web";
$password = "password";

// Create connection
$conn = new mysqli($servername, $username, $password);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}
echo "Connected successfully";
?>

then going http://192.168.0.1/mysql.php you should get Connected successfully

apache / mysql unable to connect jails with PF firewall

1 Answers1