Ssh – Traceroute not returning result whereas ssh is working fine

I may be mistaken here but I think that if MySQL binds to the localhost it only listens via a socket, so it will not be connectable via localhost:3306 (which is how the tunnelling will work).

Test this by trying to telnet to it: telnet 127.0.0.1 3306

What you are attempting to do is entirely possible and indeed is a quite often used technique. You also have got most of the setup right already. What you might be missing is an "ACCEPT" rule at "new router" allowing traffic flows from eth1 to eth1. Just add it using

iptables -I FORWARD -i eth1 -o eth1 -s 129.2.2.0/25 -j ACCEPT
iptables -I FORWARD -i eth1 -o eth1 -d 129.2.2.0/25 -j ACCEPT

It should be sufficiently safe not to circumvent any of the rules and security measures in place and yet be generic enough to allow any of your network's clients and protocols. Once you've done setting up and troubleshooting, you could restrict the rule to the protocols and destinations you are going to use:

iptables -I FORWARD -i eth1 -o eth1 -s 129.2.2.0/25 -d 192.111.222.111 -p icmp -j ACCEPT
iptables -I FORWARD -i eth1 -o eth1 -d 129.2.2.0/25 -s 192.111.222.111 -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -I FORWARD -i eth1 -o eth1 -s 129.2.2.0/25 -d 192.111.222.111 -p tcp --dport 8080 -j ACCEPT
iptables -I FORWARD -i eth1 -o eth1 -d 129.2.2.0/25 -s 192.111.222.111 -p tcp --sport 8080 ! --syn -j ACCEPT

Note that in the typical case, you hardly would see any traffic flow through the "new router" for 192.111.222.111. Linux happily would issue ICMP redirect messages informing your subnet's hosts to use "old router" for traffic to 192.111.222.111 at the first packet occurrence. And most hosts would follow (assuming they got the message - i.e. it has not been filtered anywhere) and send all subsequent packets to 192.111.222.111 directly via "old router".