How to Use iptables to Mitigate MySQL Vulnerabilities Without Upgrading

Why iptables is needed for MySQL vulnerabilities

Network security threats are increasing, and many MySQL vulnerabilities reported by big‑data security centers cannot be fixed by upgrading services in production. Using Linux iptables to limit traffic and access rights provides an indirect way to remediate these issues.

List of reported MySQL vulnerabilities

Oracle MySQL cURL component input validation error (CVE-2022-32221)

MySQL denial‑of‑service vulnerability (CVE-2023-21912)

Oracle MySQL security vulnerability (CVE-2022-37434)

Oracle MySQL curl/libcURL security vulnerability (CVE-2023-38545)

Using iptables to block/allow traffic

Install iptables on CentOS (online or offline) and verify it is running:

iptables -L -n -v

Rule policy example

# iptables rules are order‑dependent
# Allow specific IPs to access port 3306
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp -s 192.167.10.194 --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp -s 192.167.10.197 --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp -s 192.167.10.199 --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp -s 192.167.10.196 --dport 3306 -j ACCEPT

# Drop all other IPs from accessing port 3306
iptables -A INPUT -p tcp --dport 3306 -j DROP
# or use REJECT to send a response
iptables -A INPUT -p tcp --dport 3306 -j REJECT

Result

Connections from the listed IP addresses are allowed.

All other IP addresses are denied access to port 3306.

Difference between DROP and REJECT

DROP

Function: Discards packets silently.

Effect: Sender receives no response, appearing as if the request was ignored.

Use cases:

Increase security – attacker cannot tell if the port is open.

Prevent port scanning – the port appears invisible.

Save bandwidth – no reply is sent.

REJECT

Function: Discards packets and sends an explicit rejection (e.g., ICMP error).

Effect: Sender receives a clear “rejected” feedback.

Use cases:

Explicitly inform legitimate users that the port is unavailable.

Quick recovery – prevents repeated connection attempts.

Testing/debugging – helps verify network rules.

Inserting rules before existing ones

iptables matches rules in order, so insertion position matters. Use -I instead of -A to insert at the top of the INPUT chain:

iptables -I INPUT -p tcp -s 192.167.10.200 --dport 3306 -j ACCEPT

This places the new rule before all existing INPUT rules, ensuring it has higher priority.