I don't quite understand how I can connect to my database on port 3306, if my server is supposed to block everything but the shown ports.
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 193K 12M DROP all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW recent: UPDATE seconds: 60 hit_count: 12 name: DEFAULT side: source mask: 255.255.255.255
2 1934 118K all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW recent: SET name: DEFAULT side: source mask: 255.255.255.255
3 531K 189M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
4 3 192 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
5 17 1262 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
6 66 6255 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
7 2 420 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:500
8 1 376 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:4500
9 1928 117K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 524K 149M ACCEPT all -- * * 10.10.10.0/24 0.0.0.0/0 policy match dir in pol ipsec proto 50
2 413K 659M ACCEPT all -- * * 0.0.0.0/0 10.10.10.0/24 policy match dir out pol ipsec proto 50
3 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
The only idea I have is that ESTABLISHED
option may have allowed the port to go through before the firewall was setup. But still, surely the port 3306 must appear somewhere. Otherwise, how does it still know after a reboot, which ports were established previously?