Skip to main content

Firewall Whitelist

Overview​

ProxySQL 2.0.9 introduced firewall capabilities to manage query access through whitelisting. Rather than creating thousands of rules to block queries, this feature enables administrators to explicitly permit specific queries per user and schema.

Key Tables​

mysql_firewall_whitelist_users​

Defines users subject to whitelist enforcement with three operational modes:

ModeBehaviour
OFFPermits all queries
DETECTINGAllows any query, but queries not explicitly whitelisted generate an error log entry
PROTECTINGOnly executes whitelisted queries; blocks all others

mysql_firewall_whitelist_rules​

Contains approved query digests for specific user/schema combinations. Lookup is performed after mysql_query_rules processing.

Configuration Steps​

  1. Collect traffic data from stats_mysql_query_digest
  2. Populate mysql_firewall_whitelist_users with target accounts
  3. Insert approved query digests into mysql_firewall_whitelist_rules
  4. Execute LOAD MYSQL FIREWALL TO RUNTIME
  5. Enable globally via mysql-firewall_whitelist_enabled = 1

Global Variables​

VariableDescription
mysql-firewall_whitelist_enabledToggle firewall on/off
mysql-firewall_whitelist_errormsgCustom error message for blocked queries

Management Commands​

LOAD MYSQL FIREWALL TO RUNTIME;
LOAD MYSQL FIREWALL FROM MEMORY;
SAVE MYSQL FIREWALL TO DISK;
SAVE MYSQL FIREWALL FROM MEMORY;
LOAD MYSQL FIREWALL TO MEMORY;
LOAD MYSQL FIREWALL FROM DISK;

See Also​