Well in your firewall rules i don't see any OUTPUT drop/reject so the following should be enough on the master if your master is actually listening on lo and po

Well in your firewall rules i don't see any OUTPUT drop/reject so the following should be enough on the master if your master is actually listening on lo and port 3306(you can see this running for example(in linux): netstat -tnlp ): -A INPUT -i lo -p tcp --dport 3306 -j ACCEPT