File: firewall/mysql.sh

#!/usr/bin/env bash
#=============================================================================
# Sentinela ? Intelligent Linux Security Framework
# firewall/mysql.sh ? Reglas específicas para MySQL/MariaDB
#=============================================================================
#
# Puerto 3306
# Solo accesible desde localhost (127.0.0.1)
#=============================================================================

mysql_firewall_rules() {
    log_info "Configurando reglas MySQL/MariaDB (puerto ${PORT_MYSQL})..."

    # MySQL solo local (loopback)
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_MYSQL}" \
        -i lo -j ACCEPT

    # MySQL desde localhost por IP
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_MYSQL}" \
        -s 127.0.0.1 -j ACCEPT

    # MySQL desde interfaces internas (si existen)
    if ip link show docker0 &>/dev/null; then
        ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_MYSQL}" \
            -i docker0 -j ACCEPT
    fi

    # MySQL desde PHP-FPM (pool local)
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_MYSQL}" \
        -s 127.0.0.1 -j ACCEPT

    # Log y drop para MySQL desde WAN
    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_MYSQL}" \
        -j LOG --log-prefix "SENTINELA:MYSQL_WAN: " --log-uid

    ${IPTABLES} -A "${CHAIN_INPUT}" -p tcp --dport "${PORT_MYSQL}" -j DROP

    log_info "Reglas MySQL aplicadas (solo localhost)"
}