we are running mysql replication between a server outside dmz and one inside dmz, for this we need port forwarding. We have had it set up, but it recently stopped working. Just before we added a rule (rule number 01500) that would allow traffic for nrpe (monitoring with naigos).
The set up consists of a legacy redhat 5 server that runs mysql (5.1.22-rc-community-log) that should receive data from a freebsd 8.0-RELEASE server (this is 192.168.10.10) running mysql (5.1.42-log) that is behind a gateway running freebsd 8.0-RELEASE-p2.
note that I will replace all public ips with a.b.c.d-style ips...
if I telnet from the gateway to 192.168.10.10:3306, it will connect to the mysql on the correct server. if I telnet to localhost:3306, 127.0.0.1:3306 or a.b.c.f:3306 it will refused the connection immediately. on a.b.c.e telnetting to a.b.c.f:3306 does the same thing.
I excepted it to allow the traffic because:
natd process looks like :
/sbin/natd -redirect_port tcp 192.168.10.10:3306 3306 -n bce0
/etc/hosts.allow looks like :
ALL : ALL : allow
gateway firewall looks like :
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from 192.168.10.0/24 to any in via bce0
00500 deny ip from a.b.c.d/26 to any in via bce1
00600 deny ip from any to 10.0.0.0/8 via bce0
00700 deny ip from any to 172.16.0.0/12 via bce0
00800 deny ip from any to 192.168.0.0/16 via bce0
00900 deny ip from any to 0.0.0.0/8 via bce0
01000 deny ip from any to 169.254.0.0/16 via bce0
01100 deny ip from any to 192.0.2.0/24 via bce0
01200 deny ip from any to 224.0.0.0/4 via bce0
01300 deny ip from any to 240.0.0.0/4 via bce0
01400 allow tcp from a.b.c.e to me dst-port 3306
01500 allow tcp from a.b.c.d/26 to me dst-port 5666
01600 deny tcp from any to me dst-port 3306 in via bce0
01700 divert 8668 ip from any to any via bce0
01800 deny ip from 10.0.0.0/8 to any via bce0
01900 deny ip from 172.16.0.0/12 to any via bce0
02000 deny ip from 192.168.0.0/16 to any via bce0
02100 deny ip from 0.0.0.0/8 to any via bce0
02200 deny ip from 169.254.0.0/16 to any via bce0
02300 deny ip from 192.0.2.0/24 to any via bce0
02400 deny ip from 224.0.0.0/4 to any via bce0
02500 deny ip from 240.0.0.0/4 to any via bce0
02600 allow tcp from any to any established
02700 allow ip from any to any frag
02800 allow tcp from any to me dst-port 22 setup
02900 allow tcp from any to me dst-port 25 setup
03000 allow tcp from any to me dst-port 53 setup
03100 allow udp from any to me dst-port 53
03200 allow udp from me 53 to any
03300 allow udp from any 53 to any
03400 allow udp from any to any dst-port 53
03500 allow tcp from any to me dst-port 80 setup
03600 allow tcp from any to me dst-port 443 setup
03700 allow icmp from me to any
03800 allow tcp from any to any setup
03900 allow udp from me to any dst-port 53 keep-state
04000 allow udp from me to any dst-port 123 keep-state
04100 allow log ip from any to any
65535 deny ip from any to any
am I missing something here - or shouldn't the traffic be allowed?
thanks for any help and please ask if information is missing.