Proxysql: User auth per source IP

[tapuhi]

Today we have dedicated servers per app/artifact and each artifact has access only their own db cluster limited by amazon security group or msyql user auth.

We began to use shared proxysql servers per dc .
How can I create authorization rules to allow access to specific clusters based on source IPs .

[paulcaskey]

In mysql_query_rules you can direct specific applications to mysql server host groups by client IP address (client_addr). See https://github.com/sysown/proxysql/wiki/MySQL-Query-Rules
This isn't authorization exactly, but rather just routing queries where you want them to go.

[tapuhi]

I thought already of this solution but That means that each select/command will need to pass this evaluation. I was asking of some authorisation made during the authentication phase.
For now each user that has the username and password can connect to that specific host group.

[tapuhi]

I guess there is not better solution.

@renecannao any idea ?

[renecannao]

Currently the only possible option is what suggested from @paulcaskey . This opinion is meant mostly for routing, but of course can also be used to allow or deny traffic.
Due the fact that rules can be concatenated, this option doesn't create a lot of overhead.
The only drawback is that filtering happens while handling traffic, not during authentication.
Filtering during authentication is yet not available

[bmildren]

+1 being able to restrict by hostpattern during authentication would be a nice addition to proxysql's "firewall" capabilities.