Iptables: Two IP-Adresses, allow Port 3306 just for one

Question

my server has two ip's:

# IP one: 192.168.45.1 (allow MYSQL on Port 3306)
# IP two: 192.168.45.2 (disallow MYSQL on Port 3306)

.

how can i configure iptables, to drop incoming connections for a specific IP and allow it to the other?

.

#
# Allow MYSQL-Port only for 192.168.45.1!
#

 /sbin/iptables -A INPUT -p tcp 192.168.45.1 --dport 3306 -j ACCEPT
 /sbin/iptables -A INPUT -p tcp 192.168.45.2 --dport 3306 -j DROP

# END SCRIPT

this seems not to work.. :-(

Answer 1

I think you want:

/sbin/iptables -A INPUT -p tcp -d 192.168.45.1 --dport 3306 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -d 192.168.45.2 --dport 3306 -j DROP

Answer 2

Rather than enforcing this at the firewall level, have MySQL bind to 192.168.45.1 with the bind-address option. Add this to /etc/my.cnf:

bind-address=192.168.45.1