Linux – How to block all access to machine except port 3389 using Open vSwitch

Since you are on a Windows machine, these things can be done:

• Execute the following command and look for a ":3306" listener (you did not mention UDP/TCP). This will confirm there is something running on the port.

  netstat -a -n

• After this, if you are expecting incoming connections on this port and feel that the firewall may be blocking them, you could use start windows firewall logging and check the logs for dropped connections

  • Go to Windows Firewall, Advanced settings
  • Click on the Settings button next to "Local Area Connection"
  • Select "Log dropped packets"
  • Look at the log file location (if not present, define one)
  • Click OK
  • Now, when the connection attempt is made (assuming you know when this is done), look at the log file for a drop on port 3306.
  • If this is seen, you will want to add an exception for this port.

• There is one more command to check the firewall state
  (Updated for Windows 7 users -- as referred by Nick below -- use netsh advfirewall firewall)

  netsh firewall show state

  • this will list the blocked ports as well as active listening ports with application associations

• This command will dump the Windows firewall configuration detail

  netsh firewall show config

If you have an active block (incoming connections are being dropped by firewall) after you start logging, you should see that in the log.

If you are running an application/service that is listening on 3306, the firewall config should show it to be Enabled. If this is not seen, you have probably missed adding an exception with the firewall to allow this app/service.

Finally, port 3306 is typically used for MySQL. So, I presume you are running MySQL server on this windows machine. You should therefore see a listener for 3306 accepting incoming connections. If you do not see that, you need to work with your application (MySQL) to get that started first.

I suggest to use local ip subnet for your server and have private LAN between mikrotik (router) and server. Also have mikrotik directly on public ip. Then do the ip src-nat for outgoing traffic (from server to internet). All incoming traffic should be port forwarded (dst-nat). Also you can use normal layer3 ip firewall and disable layer3 firewall for layer2 / bridge network.