--- On Thu, 5/14/09, Alan DeKok <aland@deployingradius.com> wrote:

...

Though the exec method works but I have to open up the port, which means the firewall thinks that's a separate connection, which is lousy.

  Well... it *is* a separate connection.  The Disconnect-Request packet is sent from a *new* source port to the disconnect port of the client.

In the case of doing an "update disconnect" instead of exec, does it use the destination port of the accounting packet as the source, or it is also using a new source port ?

  And why do you think that something happening *second* is logged before something happening *first*?

Because the log seems to say there was a MYSQL error, no fields and SQL query did not succeed and so on.