要启用或禁用防火墙，请设置 mysql_firewall_mode系统变量。默认情况下，安装防火墙时会启用此变量。要显式控制初始防火墙状态，您可以在服务器启动时设置变量。例如，要在选项文件中启用防火墙，请使用以下行：

[mysqld]
mysql_firewall_mode=ON

修改my.cnf后重启服务器使新设置生效。

也可以在运行时禁用或启用防火墙：

SET GLOBAL mysql_firewall_mode = OFF;
SET GLOBAL mysql_firewall_mode = ON;

安装防火墙后，将适当的权限授予 MySQL 帐户或用于管理它的帐户：

MySQL 服务器允许客户端连接并从它们接收要执行的 SQL 语句。如果启用了防火墙，服务器会将每个不会立即因语法错误而失败的传入语句传递给它。根据防火墙是否接受该语句，服务器执行它或向客户端返回错误。本节描述防火墙如何完成接受或拒绝声明的任务。

防火墙配置文件

防火墙使用配置文件注册表来确定是否允许语句执行。配置文件具有以下属性：

最初，不存在配置文件，因此默认情况下，防火墙接受所有语句，并且对 MySQL 帐户可以执行的语句没有影响。要应用防火墙保护功能，需要明确的操作：

防火墙提供的基于配置文件的保护可以实现以下策略：

防火墙语句匹配

防火墙执行的语句匹配不使用从客户端收到的 SQL 语句。相反，服务器将传入的语句转换为规范化的摘要形式，防火墙操作使用这些摘要。语句规范化的好处是它可以使用单一模式对相似的语句进行分组和识别。例如，这些语句彼此不同：

SELECT first_name, last_name FROM customer WHERE customer_id = 1;
select first_name, last_name from customer where customer_id = 99;
SELECT first_name, last_name FROM customer WHERE customer_id = 143;

但它们都具有相同的规范化摘要形式：

SELECT `first_name` , `last_name` FROM `customer` WHERE `customer_id` = ?

通过使用规范化，防火墙白名单可以存储摘要，每个摘要与从客户端收到的许多不同语句相匹配。有关规范化和摘要的更多信息，请参阅第 25.10 节，“性能模式语句摘要”。

配置文件操作模式

向防火墙注册的每个配置文件都有自己的操作模式，可从以下值中选择：

当为配置文件分配任何上述模式值时，防火墙会将模式存储在配置文件中。防火墙模式设置操作也允许模式值为 RESET，但不会存储此值：将配置文件设置为RESET模式会导致防火墙删除配置文件的所有规则并将其模式设置为OFF。

As previously mentioned, MySQL associates each client session with a specific user name and host name combination known as the session account. The firewall matches the session account against registered profiles to determine which profile applies to handling incoming statements from the session:

After matching the session account to registered profiles, the firewall handles each incoming statement as follows:

MySQL Enterprise Firewall enables profiles to be registered that correspond to individual accounts. To use a firewall account profile to protect MySQL against incoming statements from a given account, follow these steps:

Observe these guidelines for firewall-related account references:

The following procedure shows how to register an account profile with the firewall, train the firewall to know the acceptable statements for that profile (its allowlist), and use the profile to protect MySQL against execution of unacceptable statements by the account. The example account, fwuser@localhost, is presumed for use by an application that accesses tables in the sakila database (available at https://mysql.net.cn/doc/index-other.html).

Use an administrative MySQL account to perform the steps in this procedure, except those steps designated for execution by the fwuser@localhost account that corresponds to the account profile registered with the firewall. For statements executed using this account, the default database should be sakila. (You can use a different database by adjusting the instructions accordingly.)

The firewall account profile now is trained for the fwuser@localhost account. When clients connect using that account and attempt to execute statements, the profile protects MySQL against statements not matched by the profile allowlist.

It is possible to detect intrusions by logging nonmatching statements as suspicious without denying access. First, put the account profile in DETECTING mode:

CALL mysql.sp_set_firewall_mode('fwuser@localhost', 'DETECTING');

Then, using the account, execute a statement that does not match the account profile allowlist. In DETECTING mode, the firewall permits the nonmatching statement to execute:

mysql> SHOW TABLES LIKE 'customer%';
+------------------------------+
| Tables_in_sakila (customer%) |
+------------------------------+
| customer                     |
| customer_list                |
+------------------------------+

In addition, the firewall writes a message to the error log:

[Note] Plugin MYSQL_FIREWALL reported:
'SUSPICIOUS STATEMENT from 'fwuser@localhost'. Reason: No match in whitelist.
Statement: SHOW TABLES LIKE ? '

To disable an account profile, change its mode to OFF:

CALL mysql.sp_set_firewall_mode(user, 'OFF');

To forget all training for a profile and disable it, reset it:

CALL mysql.sp_set_firewall_mode(user, 'RESET');

The reset operation causes the firewall to delete all rules for the profile and set its mode to OFF.

To assess firewall activity, examine its status variables. For example, after performing the procedure shown earlier to train and protect the fwuser@localhost account, the variables look like this:

mysql> SHOW GLOBAL STATUS LIKE 'Firewall%';
+----------------------------+-------+
| Variable_name              | Value |
+----------------------------+-------+
| Firewall_access_denied     | 3     |
| Firewall_access_granted    | 4     |
| Firewall_access_suspicious | 1     |
| Firewall_cached_entries    | 4     |
+----------------------------+-------+

这些变量分别表示拒绝、接受、记录为可疑和添加到缓存中的语句数。Firewall_access_granted 计数为 4 是因为mysql客户端每次使用注册帐户连接 3 次时@@version_comment 发送的 语句，加上未在模式中阻塞的语句。 SHOW TABLESDETECTING