ftp is more sane than mysql to block here, port wise...if mysql is open...it should only be based on a whitelist anyway