{"id":4943,"date":"2021-09-07T08:26:29","date_gmt":"2021-09-07T07:26:29","guid":{"rendered":"http:\/\/dasini.net\/blog\/?p=4943"},"modified":"2021-09-14T08:44:27","modified_gmt":"2021-09-14T07:44:27","slug":"discovering-mysql-database-service-episode-6-update-the-private-subnet-security-list","status":"publish","type":"post","link":"https:\/\/dasini.net\/blog\/2021\/09\/07\/discovering-mysql-database-service-episode-6-update-the-private-subnet-security-list\/","title":{"rendered":"Discovering MySQL Database Service \u2013 Episode 6 \u2013 Update the Private Subnet Security List"},"content":{"rendered":"\n

MySQL<\/a>, the world’s most popular open source database<\/strong>, is available as a managed cloud service<\/strong> in Oracle Cloud Infrastructure<\/a><\/strong> (OCI<\/a><\/strong>) under the name of MySQL Database Service<\/a><\/strong> (MDS<\/a><\/strong>).<\/p>\n\n\n\n

MySQL Database Service is a fully managed cloud service, 100% Developed, Managed and Supported by the MySQL Team.<\/strong><\/p><\/blockquote><\/figure>\n\n\n\n

This is the sixth<\/span> episode of \u00ab\u00a0Discovering MySQL Database Service<\/a><\/em><\/strong><\/em><\/strong>\u00ab\u00a0, a series of tutorials where I will show you, step by step, how to use MySQL Database Service and some other Oracle Cloud Infrastructure services. <\/p>\n\n\n\n

Please also note that you can run this tutorial and thus try MySQL Database Service & the other Oracle Cloud Infrastructure services for free<\/span><\/strong> by starting your 30-day trial<\/a>.<\/p>\n\n\n\n

\"MySQL<\/figure><\/div>\n\n\n\n
\n

Planning episodes<\/h2>\n\n\n\n
  1. Introduction to the series Discovering MySQL Database Service<\/em><\/strong><\/a> <\/li>
  2. Create a compartment<\/a><\/li>
  3. Create a Virtual Cloud Network<\/a><\/li>
  4. Dump your MySQL data into an Object Storage bucket<\/a><\/li>
  5. Create a MySQL DB system from a MySQL Shell dump<\/a><\/li>
  6. Update the Private Subnet Security List<\/a><\/li>
  7. Use a Bastion SSH port forwarding session<\/a><\/li>
  8. Connect to MySQL Database Service Using MySQL Shell<\/a><\/li>
  9. Connect to MySQL Database Service Using MySQL Workbench<\/a><\/li>
  10. Connect to MySQL Database Service Using OCI Cloud Shell<\/a><\/li>
  11. MySQL Database Service Features Overview<\/li><\/ol>\n<\/div><\/div>\n\n\n\n

    <\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Episode 6 – Update the Private Subnet Security List<\/h1>\n\n\n\n

    In the previous episode<\/a> we’ve seen how to create a MySQL DB system from a MySQL Shell dump stored into an Oracle Cloud Infrastructure object storage bucket. One more step to our Discovering MySQL Database Service<\/em><\/strong> journey. <\/p>\n\n\n\n

    In this episode, we’ll introduce the concept of Security Lists<\/a> a virtual firewall to control traffic at the network packet level.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Security Lists<\/h2>\n\n\n\n

    A security list<\/a> acts as a virtual firewall for an instance, with ingress and egress rules that specify the types of traffic allowed in and out.
    Each security list is enforced at the VNIC level. However, you configure your security lists at the subnet level<\/em>, which means that all VNICs in a given subnet are subject to the same set of security lists.
    The security lists apply to a given VNIC whether it’s communicating with another instance in the VCN or a host outside the VCN.<\/p>\n\n\n\n

    The default security list comes with an initial set of stateful rules, which should in most cases be changed to only allow inbound traffic from authorized subnets relevant to the region that homes that VCN or subnet.<\/p>\n\n\n\n

    Note<\/span>
    Your OCI user must be part of a group that has the right privileges in order to work with Security Lists.
    At least the following rules:
    Allow group SecListAdmins to manage security-lists in tenancy
    Allow group SecListAdmins to manage vcns in tenancy<\/em>
    Please see:     Working with Security Lists<\/a><\/em><\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Update the Security List<\/h2>\n\n\n\n

    Go to the OCI console, in the menu, go to: Networking<\/span><\/em> \/ Virtual Cloud Networks<\/span><\/em>
    And select (click on) your VCN ( Demo_VCN<\/em> in this example), and please check that you are in the right compartment.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    Select (click on) the private<\/span><\/strong> subnet<\/strong> (Private Subnet-Demo_VCN<\/em> in this example):<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    Select the Security List for the Private Subnet<\/strong> (Security List for Private Subnet-Demo_VCN<\/em> in this example):<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    Click on Add Ingress Rules<\/span><\/em>:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    Now we are adding our ingress rules in order to be able to connect to the MDS instance from the VCN on ports 3306 (MySQL classic protocol) and 33060 (MySQL X protocol).<\/p>\n\n\n\n

    The information to provide are (please adapt to your context):
    + Source type: CIDR
    + Source CIDR: 10.0.0.0\/16
    + IP protocol: TCP
    + Source port range: All
    + Destination port range: 3306,33060<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Then click on Add Ingress Rules<\/span><\/em>.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    You should end up with something like:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    Well, that’s all for today!
    In this episode, we have seen how to allow traffic from the VCN to the MySQL Database Service instance on ports 3306 & 33060.
    We are now able to connect to our MySQL instance…<\/p>\n\n\n\n

    Next episode is:<\/p>\n\n\n\n

    Use a Bastion SSH port forwarding session<\/a><\/strong><\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Resources<\/h2>\n\n\n\n