Re: NAT & MySQL

[Jeffrey Laramie <JALaramie@Loudoun-Fairfax.com>]

Mark E. Donaldson wrote:

> The ACK packets you see in your dump are probably being dropped at the 
> firewall because a state table entry does not exist.  So you need to 
> add a NEW rule to do this:
>  
> iptables -A FORWARD -i ppp0 -o eth0 -m state --state NEW -j ACCEPT
>  
> this rule will then allow your ESTABLISHED,RELATED rule to work and 
> permit those ACK packets to pass.
>
>

Hi Mark,

I'm not sure I understand what this rule does for him. Only the first 
packet from the web client would be NEW and based on his FORWARD rules 
that's been accepted and the dump shows it went through (although I'd 
still like to see his SNAT rule). Your rule would open his mysql server 
to any NEW packet. Are you saying that the RELATED ACK packets won't go 
through unless the first packet is matched with a NEW state and makes an 
entry in the state table?

Jeff