![\"MySQL](\"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/mysql-5-7-docker-nftables-firewall.webp\")
<\/figure>\nInstalling such an old version directly on the host brings several problems. The official repositories of current distributions no longer offer it. Third-party packages risk conflicting with the rest of the system. An OS upgrade could break it.<\/p>\n
So we decided to isolate it in a Docker container<\/strong>: the host stays clean and up to date. The database version is fixed and reproducible. Data and configuration live in a folder that is easy to back up and move.<\/p>\n This article tells how we set it up and, above all, the obstacles we met along the way. First the unintentional exposure of port 3306, then an iptables error at reboot. Last, writing a firewall with nftables<\/strong> that lets through only authorised IPs.<\/p>\n Note:<\/strong> MySQL 5.7 reached end of life (EOL) in October 2023 and no longer receives security patches. It is a stopgap: the goal remains to migrate to MySQL 8.x or MariaDB. That is exactly why it is even more important not to leave it exposed.<\/p>\n<\/blockquote>\n The Protect it with A few choices worth noting:<\/p>\n The line The most insidious part is that Docker writes its own rules straight into the kernel firewall. These are evaluated before those of UFW or firewalld. Having a firewall running is not enough<\/strong>: the port stays reachable. Docker’s own documentation on packet filtering and firewalls<\/a> describes this behaviour.<\/p>\n The possible approaches are:<\/p>\n For case 4 you need a firewall that correctly filters the traffic of the ports published by Docker.<\/p>\n After touching the firewall, The error doesn’t depend on the compose file: the Our This command deletes all<\/strong> nftables tables, including those created by Docker. On top of that the file contained a static copy of Docker’s rules. The bridge name ( Golden rule:<\/strong> with Docker, in the nftables file you don’t use The principle is this: the ports published by Docker are rewritten with DNAT and then forwarded by the host to the container, so they go through the To avoid touching other people’s tables we use the How the guard works:<\/p>\n Compatibility:<\/strong> in a first version we used Keep a spare SSH session open, then:<\/p>\n For loading at boot, make sure the service is enabled ( To make it permanent, also update the set in the file.<\/p>\n From the authorised server:<\/p>\n From any other IP:<\/p>\n On the server, the drop rule’s counter must grow with every unauthorised attempt:<\/p>\n The firewall doesn’t replace database permissions. Create the user with the host limited to the client’s IP:<\/p>\n If the TCP connection succeeds but MySQL answers Do you have questions or a different solution to the same problem? Write it in the comments. If you run MySQL on Debian, see also MySQL won’t start after a Debian 12 upgrade<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" How to run MySQL 5.7 in Docker on a modern server without exposing it to the internet: docker-compose, a closed port and an nftables firewall.<\/p>\n","protected":false},"author":1,"featured_media":757,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wpai_generated_summary":"","footnotes":""},"categories":[361],"tags":[308,328,292,312],"class_list":["post-271","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-servers-databases","tag-docker-en","tag-firewall-en","tag-mysql-en","tag-nftables-en"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
\n1. Folder structure<\/h2>\n
\/opt\/mysql57\/\n\u251c\u2500\u2500 docker-compose.yml\n\u251c\u2500\u2500 .env\n\u251c\u2500\u2500 conf.d\/ # configurazioni personalizzate (my.cnf aggiuntivi)\n\u251c\u2500\u2500 data\/ # dati del database (volume persistente)\n\u2514\u2500\u2500 logs\/\n<\/code><\/pre>\n.env<\/code> file holds the credentials, so they don’t end up in the compose file:<\/p>\nTZ=Europe\/Rome\nMYSQL_ROOT_PASSWORD=una_password_molto_lunga_e_casuale\nMYSQL_DATABASE=nome_db\nMYSQL_USER=nome_utente\nMYSQL_PASSWORD=altra_password_robusta\n<\/code><\/pre>\nchmod 600 .env<\/code>.<\/p>\n2. MySQL 5.7 in Docker: the docker-compose.yml<\/h2>\n
services:\n mysql57:\n image: mysql:5.7\n container_name: mysql57\n restart: unless-stopped\n env_file:\n - .env\n ports:\n - \"3306:3306\"\n environment:\n TZ: \"${TZ:-Europe\/Rome}\"\n MYSQL_ROOT_PASSWORD: \"${MYSQL_ROOT_PASSWORD}\"\n MYSQL_DATABASE: \"${MYSQL_DATABASE}\"\n MYSQL_USER: \"${MYSQL_USER}\"\n MYSQL_PASSWORD: \"${MYSQL_PASSWORD}\"\n command:\n - --default-authentication-plugin=mysql_native_password\n volumes:\n - .\/data:\/var\/lib\/mysql\n - .\/conf.d:\/etc\/mysql\/conf.d:ro\n - .\/logs:\/var\/log\/mysql\n healthcheck:\n test: [\"CMD-SHELL\", \"mysqladmin ping -h 127.0.0.1 -uroot -p$$MYSQL_ROOT_PASSWORD --silent\"]\n interval: 20s\n timeout: 5s\n retries: 10\n start_period: 45s\n ulimits:\n nofile:\n soft: 65535\n hard: 65535\n<\/code><\/pre>\n\n
restart: unless-stopped<\/code><\/strong>: the database restarts by itself after a server reboot.<\/li>\n$$<\/code> makes the variable expand inside the container and not in Compose).<\/li>\nulimits nofile<\/code><\/strong>: avoids the “too many open files” error under load.<\/li>\n<\/ul>\n3. First problem: the port is open to the whole world<\/h2>\n
- \"3306:3306\"<\/code> is equivalent to 0.0.0.0:3306:3306<\/code>. Docker publishes the port on all interfaces<\/strong> of the host, including the public one.<\/p>\n\n
\"127.0.0.1:3306:3306\"<\/code>, if the database is only used by the host or through an SSH tunnel.<\/li>\n4. Second problem: an iptables error at startup<\/h2>\n
docker compose up<\/code> returned:<\/p>\nfailed to create network mysql57_default: Error response from daemon:\nFailed to Setup IP tables: Unable to enable ACCEPT OUTGOING rule:\n(iptables failed: iptables --wait -t filter -A DOCKER-FORWARD -i br-... -j ACCEPT:\niptables: No chain\/target\/match by that name.\n<\/code><\/pre>\nDOCKER-FORWARD<\/code> chain (introduced in recent Docker versions) no longer existed. It had been deleted by something that cleaned up the rules after<\/strong> the daemon started. Restarting Docker (systemctl restart docker<\/code>) recreates it, but the problem comes back until the real culprit is removed.<\/p>\nThe culprit:
flush ruleset<\/code><\/h3>\n\/etc\/nftables.conf<\/code> began with:<\/p>\nflush ruleset\n<\/code><\/pre>\nbr-278550235c3f<\/code>) and the container IP (172.18.0.2<\/code>) were written by hand. But the bridge name changes every time the Compose network is recreated, so the copy immediately became obsolete. The ip nat<\/code> table also clashed with the one managed by Docker.<\/p>\nflush ruleset<\/code> and you don’t copy its rules. You manage only your own firewall, in dedicated tables.<\/p>\n5. The nftables firewall for MySQL 5.7 in Docker<\/h2>\n
forward<\/code><\/strong> chain, not input<\/code>. A drop<\/code> rule in a chain of ours, forward<\/code>, with a slightly lower priority (so evaluated first). It drops the packet regardless of Docker’s accept<\/code> rules.<\/p>\ntable ...<\/code> + delete table ...<\/code> pattern: it makes the file re-runnable without errors and without flush<\/code>.<\/p>\n\/etc\/nftables.conf<\/code>:<\/p>\n#!\/usr\/sbin\/nft -f\n\n# NIENTE \"flush ruleset\": cancellerebbe anche le tabelle di Docker\n\n# ---------------- firewall host ----------------\ntable inet filter\ndelete table inet filter\n\ntable inet filter {\n\n chain input {\n type filter hook input priority filter; policy drop;\n ct state established,related accept\n iifname \"lo\" accept\n ip6 nexthdr icmpv6 accept\n iifname \"enp7s0\" accept # rete privata\n ip saddr 203.0.113.20 tcp dport 22 accept # SSH da host fidato\n ip saddr 203.0.113.30 tcp dport 22 accept # SSH da VPN\n ip saddr 203.0.113.20 icmp type echo-request accept\n tcp dport { 80, 443 } accept\n }\n\n chain output {\n type filter hook output priority filter; policy accept;\n }\n}\n\n# ---------------- guardia MySQL (porta pubblicata da Docker) ----------------\ntable ip mysql_guard\ndelete table ip mysql_guard\n\ntable ip mysql_guard {\n set allowed {\n type ipv4_addr\n flags interval\n elements = {\n 203.0.113.10 # phpMyAdmin\n }\n }\n\n chain forward {\n type filter hook forward priority filter - 5; policy accept;\n iifname \"enp7s0\" accept\n ct status dnat tcp dport 3306 ip saddr @allowed accept\n ct status dnat tcp dport 3306 counter drop\n }\n}\n<\/code><\/pre>\n\n
ct status dnat<\/code> selects only packets that went through DNAT, that is those headed to the ports published by Docker.<\/li>\nallowed<\/code> set; the second drops everyone else and counts them (counter<\/code>).<\/li>\n127.0.0.1<\/code>) and traffic between containers on the same network doesn’t go through the router’s forward. So it isn’t touched.<\/li>\n<\/ul>\n\n
ct original proto-dst 3306<\/code>, but some versions of nft<\/code> answer with “Can’t parse symbolic invalid expressions”<\/em>. In the forward<\/code> hook the DNAT has already happened and the container port matches the published one (3306:3306<\/code>). So tcp dport 3306<\/code> combined with ct status dnat<\/code> is equivalent and works everywhere. If you change the mapping (e.g. 3307:3306<\/code>), the rule must be adapted to the internal port.<\/p>\n<\/blockquote>\nApplying the changes without locking yourself out<\/h3>\n
nft -c -f \/etc\/nftables.conf # solo verifica della sintassi\nnft delete table ip nat # una tantum: elimina la vecchia copia statica\nnft -f \/etc\/nftables.conf\nsystemctl restart docker # Docker ricrea le sue tabelle pulite\ncd \/opt\/mysql57 && docker compose up -d\n<\/code><\/pre>\nsystemctl enable --now nftables<\/code>) and that \/etc\/nftables.conf<\/code> does not contain flush ruleset<\/code>.<\/p>\nManaging IPs at runtime<\/h3>\n
nft add element ip mysql_guard allowed { 203.0.113.50 }\nnft delete element ip mysql_guard allowed { 203.0.113.50 }\n<\/code><\/pre>\n6. Verification<\/h2>\n
nc -zv IP_PUBBLICO_DB 3306 # deve rispondere \"succeeded\"\n<\/code><\/pre>\nnmap -Pn -p 3306 IP_PUBBLICO_DB # deve risultare \"filtered\" \/ timeout\n<\/code><\/pre>\nnft list chain ip mysql_guard forward\nss -tlnp | grep 3306\n<\/code><\/pre>\n7. Second barrier: the MySQL users<\/h2>\n
CREATE USER 'pma_user'@'203.0.113.10' IDENTIFIED BY 'password_robusta';\nGRANT ALL ON nome_db.* TO 'pma_user'@'203.0.113.10';\nFLUSH PRIVILEGES;\n<\/code><\/pre>\nAccess denied<\/code>, the problem is here and not in the firewall.<\/p>\n8. Things to remember about MySQL 5.7 in Docker<\/h2>\n
\n
input<\/code> or forward<\/code>) is the key to everything.<\/li>\nflush ruleset<\/code><\/strong> on a host with Docker; use dedicated tables.<\/li>\n.\/logs<\/code> and consider changing the passwords<\/strong>, especially root’s.<\/li>\n