MySQL remote access through LXD

LXC
1

Hi, lover of LXD from what I’ve seen so far but I’m a bit of a noob/newbie.

I have a MySQL database running on a container (M1) with a user user@domain.com. The domain.com IP points to my host, H1. I have configured H1 so that 10.243.164.1 is the first checked nameserver, and domain.com is redirected to M1 via LXD’s dnsmasq:

$ lxc network show lxdbr0 | grep dnsmasq
  raw.dnsmasq: host-record=domain.com,10.243.164.69

So that when I run mysql -u user -h domain.com -p from H1, I can enter the mysql database running on M1 without issue.

The issue comes when I want my client machine, C1, to access said database. I am trying to work out how I can force C1 to use H1’s DNS, i.e. at present I believe that running mysql -h domain.com is simply trying to use H1’s mysql database, whereas I actually want some sort of “pass-through” based on domain name.

I do have a stream rule successfully set up in a reverse nginx-proxy container which is allowing commands to be sent from the master (remote) to the slave (M1), but I think this is operating at a different layer which is why the issue is occurring.

I am also using ufw but with the following relevant rules:

Anywhere                   ALLOW FWD   Anywhere on lxdbr0        
Anywhere on lxdbr0         ALLOW FWD   Anywhere                  
Anywhere (v6)              ALLOW FWD   Anywhere (v6) on lxdbr0   
Anywhere (v6) on lxdbr0    ALLOW FWD   Anywhere (v6)

If anyone can point me to how I could allow such forwarding based on domain name that would be great. I was able to do it, but only if I passed all incoming traffic on port 3306 to M1; however I will have several slaves here and need to access each one remotely so mysql -h example1 dot domain dot com and mysql -h example2 dot domain dot com will need to connect to two different lxd databases.

Thanks in advance for your help.

2

this IP is local IP and not WAN, there multiple solution for your issue:

  • You can give LAN IP from your router (if client and server in same network)
  • Use IPv6 WAN Address (if your ISP support it)
  • Use Incus client in other machine and add your remote machine to it then use Incus domains (@stgraber I don’t know if Incus will route the traffic)
3

Thanks for your response. Yes, I am aware this is a local IP. C1 is not in the same network as H1. Ultimately I will be using Google Looker Studio for this purpose, so I don’t think I will be able to use Incus for this purpose unfortunately!

Is there nothing I can add to the lxc config device add M1 mysql proxy listen=tcp:localhost:3306 connect=tcp:10.243.164.69:3306 command that forces only incoming connections from test.domain1.com to be forwarded?
`