I got a Tomcat server running a web application that must access a mysql server via Hibernate on the same machine.

So, I added a rule for port 3306 to my iptables script but tomcat cannot connect to the mysql server for some reason. I need to reset all iptables rules - Then tomcat can connect to the mysql server again.

All the other iptables rules work perfectly though.

What's wrong?

Here is my script:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp --dport 24 -j ACCEPT

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -p tcp -s localhost --dport 8009 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --dport 8009 -j ACCEPT

iptables -A INPUT -p tcp -s localhost --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d localhost --dport 3306 -j ACCEPT

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

iptables -A INPUT -p tcp --dport 25 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

iptables -A INPUT -p tcp --dport 587 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT

iptables -A INPUT -p tcp --dport 465 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT

iptables -A INPUT -p tcp --dport 110 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 110 -j ACCEPT

iptables -A INPUT -p tcp --dport 995 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 995 -j ACCEPT

iptables -A INPUT -p tcp --dport 143 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 143 -j ACCEPT

iptables -A INPUT -p tcp --dport 993 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 993 -j ACCEPT

iptables -A INPUT -j DROP

My /etc/hosts file:

# nameserver config
# IPv4
127.0.0.1 localhost
46.4.7.93 mydomain.com
46.4.7.93 Ubuntu-1004-lucid-64-minimal
46.4.7.93 horst

# IPv6
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

Having a look into the iptables logs, gives me this:

Jun 22 16:52:43 Ubuntu-1004-lucid-64-minimal kernel: [  435.111780] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52432 DF PROTO=TCP SPT=56108 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:46 Ubuntu-1004-lucid-64-minimal kernel: [  438.110555] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52433 DF PROTO=TCP SPT=56108 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:46 Ubuntu-1004-lucid-64-minimal kernel: [  438.231954] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48020 DF PROTO=TCP SPT=56109 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:52:49 Ubuntu-1004-lucid-64-minimal kernel: [  441.229778] denied-input IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48021 DF PROTO=TCP SPT=56109 DPT=8009 WINDOW=32792 RES=0x00 SYN URGP=0 
Jun 22 16:53:57 Ubuntu-1004-lucid-64-minimal kernel: [  508.731839] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=78.92.97.67 DST=46.4.7.93 LEN=64 TOS=0x00 PREC=0x00 TTL=122 ID=23053 DF PROTO=TCP SPT=1672 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0 
Jun 22 16:53:59 Ubuntu-1004-lucid-64-minimal kernel: [  511.625038] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=78.92.97.67 DST=46.4.7.93 LEN=64 TOS=0x00 PREC=0x00 TTL=122 ID=23547 DF PROTO=TCP SPT=1672 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0 
Jun 22 16:54:22 Ubuntu-1004-lucid-64-minimal kernel: [  533.981995] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=27.254.39.16 DST=46.4.7.93 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=6549 PROTO=TCP SPT=6005 DPT=33796 WINDOW=64240 RES=0x00 ACK SYN URGP=0 
Jun 22 16:54:44 Ubuntu-1004-lucid-64-minimal kernel: [  556.297038] denied-input IN=eth0 OUT= MAC=6c:62:6d:85:bf:0e:00:26:88:75:dc:01:08:00 SRC=94.78.93.41 DST=46.4.7.93 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=7712 PROTO=TCP SPT=57598 DPT=445 WINDOW=512 RES=0x00 SYN URGP=0