我们在dmz之外的服务器和dmz之间运行mysql复制，为此我们需要端口转发。 我们已经成立了，但最近停止了工作。 在我们添加一个规则（规则号码01500）之前，会允许nrpe的stream量（使用naigos进行监控）。
该设置包含一个运行mysql（5.1.22-rc-community-log）的传统redhat 5服务器，该服务器应该从运行mysql的freebsd 8.0-RELEASE服务器（这是192.168.10.10）接收数据（5.1.42-log ）在运行freebsd 8.0-RELEASE-p2的网关后面。
请注意，我将用abcd式ipsreplace所有公共ips …
如果我从网关Telnet到192.168.10.10:3306，它将连接到正确的服务器上的MySQL。 如果我telnet到本地主机：3306,127.0.0.1:3306或abcf：3306它将立即拒绝连接。 在abc telnet到abcf：3306做同样的事情。
我除了允许交通，因为：
natd过程如下所示：
/sbin/natd -redirect_port tcp 192.168.10.10:3306 3306 -n bce0 /etc/hosts.allow看起来像：
ALL : ALL : allow
网关防火墙看起来像：
00100 allow ip from any to any via lo0 00200 deny ip from any to 127.0.0.0/8 00300 deny ip from 127.0.0.0/8 to any 00400 deny ip from 192.168.10.0/24 to any in via bce0 00500 deny ip from abcd/26 to any in via bce1 00600 deny ip from any to 10.0.0.0/8 via bce0 00700 deny ip from any to 172.16.0.0/12 via bce0 00800 deny ip from any to 192.168.0.0/16 via bce0 00900 deny ip from any to 0.0.0.0/8 via bce0 01000 deny ip from any to 169.254.0.0/16 via bce0 01100 deny ip from any to 192.0.2.0/24 via bce0 01200 deny ip from any to 224.0.0.0/4 via bce0 01300 deny ip from any to 240.0.0.0/4 via bce0 01400 allow tcp from abce to me dst-port 3306 01500 allow tcp from abcd/26 to me dst-port 5666 01600 deny tcp from any to me dst-port 3306 in via bce0 01700 divert 8668 ip from any to any via bce0 01800 deny ip from 10.0.0.0/8 to any via bce0 01900 deny ip from 172.16.0.0/12 to any via bce0 02000 deny ip from 192.168.0.0/16 to any via bce0 02100 deny ip from 0.0.0.0/8 to any via bce0 02200 deny ip from 169.254.0.0/16 to any via bce0 02300 deny ip from 192.0.2.0/24 to any via bce0 02400 deny ip from 224.0.0.0/4 to any via bce0 02500 deny ip from 240.0.0.0/4 to any via bce0 02600 allow tcp from any to any established 02700 allow ip from any to any frag 02800 allow tcp from any to me dst-port 22 setup 02900 allow tcp from any to me dst-port 25 setup 03000 allow tcp from any to me dst-port 53 setup 03100 allow udp from any to me dst-port 53 03200 allow udp from me 53 to any 03300 allow udp from any 53 to any 03400 allow udp from any to any dst-port 53 03500 allow tcp from any to me dst-port 80 setup 03600 allow tcp from any to me dst-port 443 setup 03700 allow icmp from me to any 03800 allow tcp from any to any setup 03900 allow udp from me to any dst-port 53 keep-state 04000 allow udp from me to any dst-port 123 keep-state 04100 allow log ip from any to any 65535 deny ip from any to any
我在这里错过了什么 – 或者不应该允许交通？
感谢您的帮助，请询问是否缺less信息。
事实certificate，mysql的stream量允许语句“阻塞”它，因为它被阻止到达实际转发的转移规则。
testing是通过添加这个规则来完成的：
ipfw添加1350 skipto 1700 tcp从abce到我dst-port 3306
因此规则1400和1600将从我们的防火墙中移除，并且mysql复制将继续保持快乐。