I've this iptables rules on first server which has the role of a client connecting to a second mysql server through LAN adapter.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:44135]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Feb 4 20:33:41 2015
# Generated by iptables-save v1.4.7 on Wed Feb 4 20:33:41 2015
*nat
:PREROUTING ACCEPT [76:10856]
:POSTROUTING ACCEPT [11:734]
:OUTPUT ACCEPT [11:734]
COMMIT
# Completed on Wed Feb 4 20:33:41 2015
# Generated by iptables-save v1.4.7 on Wed Feb 4 20:33:41 2015
*mangle
:PREROUTING ACCEPT [2739:2511918]
:INPUT ACCEPT [2739:2511918]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1913:165876]
:POSTROUTING ACCEPT [1913:165876]
COMMIT
What's happening is that as soon as I do:
service iptables restart
it seems that all the MYSQL connections to a second server works correctly but only for a small period of time, usually 1-2 minutes, but in this 1 -2 minutes the connections to nginx (webserver, 80 port) doesn't work. After 1-2 minutes, it happens that webserver works and MYSQL doesn't work. Tryed iptables-save command too so far but nothing changed.
This is the firewall conf o second mysql server:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2785:425650]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -d 192.168.1.1/32 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i lo -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -p tcp -m tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT