iptables -t mangle -A PREROUTING -p tcp --dport 33006 -j MARK --set-mark 123456
iptables -t nat -A PREROUTING -d EXTERNAL_IP -i eth0 -p tcp --dport 33006 -j DNAT --to-destination EXTERNAL_IP:3306
iptables -t filter -A INPUT -p tcp --dport 3306 -m mark --mark 123456 -j ACCEPT