The ACK=20 packets you see in your dump are probably being dropped at the firewall = because=20 a state table entry does not exist. So you need to add a NEW rule = to do=20 this:

iptables -A FORWARD -i ppp0 -o eth0 -m state = --state NEW=20 -j ACCEPT

this = rule will=20 then allow your ESTABLISHED,RELATED rule to work and permit those ACK = packets to=20 pass.

From: = netfilter-admin@lists.netfilter.org=20 [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of=20 adburne
Sent: Tuesday, November 25, 2003 4:18 = AM
To:=20 netfilter@lists.netfilter.org
Subject: NAT &=20 MySQL

Someone can make NAT with mysql? I've tried for a long time = without=20 make it work.

My natural language is spanish, sorry by mistakes writing in=20 english.

This is the situation:

I've have a linux box as gateway between my lan and internet = routing=20 paquets without problems, I need access from internet another = linux box=20 running apache and mysql on my private lan.

To do this work I try to use nat; with apache all works ok, = but with=20 mysql can't connect. I'll be looking on different network devices = using=20 tcpdump to find what's wrong.

This is what tcpdump show on device eth0 on my mysql server = (inside=20 the lan), there is a petition from 200.10.10.1 (internet client) = to=20 192.168.0.80 (mysql lan server), this reply with ack, but = internet=20 client don't

reply. Any clue? =3D)

200.10.10.1.56405 > 192.168.0.80.3306: S = 2205542765:2205542765(0)=20 win 5840 <mss
1412,sackOK,timestamp 620645629 0,nop,wscale = 0>=20 (DF)
192.168.0.80.3306 > 200.10.10.1.56405: S=20 2497023396:2497023396(0) ack 2205542766
win 5792 <mss=20 1460,sackOK,timestamp 95764658 620645629,nop,wscale 0>=20 (DF)
200.10.10.1.56405 > 192.168.0.80.3306: R=20 2205542766:2205542766(0) win 0 (DF)
200.10.10.1.56405 >=20 192.168.0.80.3306: S 2205542765:2205542765(0) win 5840=20 <mss
1412,sackOK,timestamp 620648701 0,nop,wscale 0>=20 (DF)
192.168.0.80.3306 > 200.10.10.1.56405: S=20 2503023731:2503023731(0) ack 2205542766
win 5792 <mss=20 1460,sackOK,timestamp 95765258 620648701,nop,wscale 0>=20 (DF)
200.10.10.1.56405 > 192.168.0.80.3306: R=20 2205542766:2205542766(0) win 0 (DF)

The forward rules on the gateway are:

# "Accept forward all connections to port 3306 on=20 ppp0"
iptables -A FORWARD -p tcp -i ppp0 --dport 3306 -o eth0 = -j=20 ACCEPT

# "All stablished connections are = ok"
iptables -A=20 FORWARD -i ppp0 -o eth0 -m state --state=20 ESTABLISHED,RELATED -j ACCEPT
# "All connection from = inside=20 to outside are accepted"
iptables -A FORWARD -i eth0=20 -o ppp0 -j ACCEPT

# "Rest go away"

iptables -A FORWARD -j REJECT

NAT rule:

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 3306 -j = DNAT=20 --to 192.168.0.80 -s 200.10.10.1

If someone can make the light turn on, thanks!!!!

Alejandro

________________________________________________________________= _
<= IMG alt=3D""=20 hspace=3D0 src=3D"cid:268012019@25112003-2959" align=3Dbaseline = border=3D0> =20 IncrediMail - El E-mail ha evolucionado finalmente - = <= FONT=20 face=3D"Times New Roman" size=3D3>Haga clic=20 aqu=ED ------=_NextPart_001_001D_01C3B346.98690D50-- ------=_NextPart_000_001C_01C3B346.98669C50 Content-Type: image/gif; name="IMSTP.gif" Content-Transfer-Encoding: base64 Content-ID: <268012019@25112003-2959> R0lGODlhFAAPALMIAP9gAM9gAM8vAM9gL/+QL5AvAGAvAP9gL////wAAAAAAAAAAAAAAAAAAAAAA AAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQJFAAIACwAAAAAFAAPAAAEVRDJSaudJuudrxlEKI6B URlCUYyjKpgYAKSgOBSCDEuGDKgrAtC3Q/R+hkPJEDgYCjpKr5A8WK9OaPFZwHoPqm3366VKyeRt E30tVVRscMHDqV/u+AgAIfkEBWQACAAsAAAAABQADwAABBIQyUmrvTjrzbv/YCiOZGmeaAQAIfkE CRQACAAsAgABABAADQAABEoQIUOrpXIOwrsPxiQUheeRAgUA49YNhbCqK1kS9grQhXGAhsDBUJgZ AL2Dcqkk7ogFpvRAokSn0p4PO6UIuUsQggSmFjKXdAgRAQAh+QQFCgAIACwAAAAAFAAPAAAEEhDJ Sau9OOvNu/9gKI5kaZ5oBAAh+QQJFAAIACwCAAEAEAANAAAEShAhQ6ulcg7Cuw/GJBSF55ECBQDj 1g2FsKorWRL2CtCFcYCGwMFQmBkAvYNyqSTuiAWm9ECiRKfSng87pQi5SxCCBKYWMpd0CBEBACH5 BAVkAAgALAAAAAAUAA8AAAQSEMlJq7046827/2AojmRpnmgEADs= ------=_NextPart_000_001C_01C3B346.98669C50--