Yes maybe the port 4502 is the listening port of LS that waiting connection from GS. Of course we are far away from this step.Finaly i follow your way Tetris and i managed to change the port of the client using MHS. Here is the offsets ->
-----Client OFFSETS----
LS AUTH PORT: sframe.exe+30722A
1ST IN THE LIST GAMESERVER IP: sframe.exe+8081A8
1ST IN THE LIST GAMESERVER PORT: sframe.exe+808228
------------------------
How i know these offsets. I have an account on official server. I used a proxy+packets capturer(handmade by me) app and i captured all the packets that client exchanges with LS and GS during a normal logon.I have all the sequence step by step. We may need it for later use.
So now i can simulate a rappelz logon offline

if anyone need this packet array i can send it.Maybe a good packet decoding guy can help us this way.
Now about the ...db.auth.port:4500...
If i understand right what you mean, why i have to set this port to 4500 since [db.auth.port] is for the SQL listening port 1433,34 or if you have express sql its 1039. So in my opt files i have to set this at 1039. Normaly princessaurora should listen at 4500-clients,4501-console,4502-GS. So something is wrong here.
About GameServer + SQl connection. Gameserver attempts to connect to cadb.nflavor.com but using the right way we redirect it localy. The problem is the port:1433,34. for me because as i said i use Express SQL is 1039. I used the same app as before for packets capture in order to redirect the connection from 1433 to 1039 and i captured the exchanged packets in order to try find out the problem. Here i share the packets with you:
-Packets Exchanged During CaptainHerlock Attempts a Connection with SQL-
PACKET FROM CLIENT TO SERVER
PacketID:1<>127.0.0.1 ----> 127.0.0.1---- Size:41
)ÿUT
------------------------------------------------------
PACKET FROM SERVER TO CLIENT
PacketID:2<>127.0.0.1 ----> 127.0.0.1---- Size:37
%ÿ@
------------------------------------------------------
PACKET FROM CLIENT TO SERVER
PacketID:3<>127.0.0.1 ----> 127.0.0.1---- Size:78
NA=LŒê�v7ÔaÂÌõ£ˆ/ÿ½¬`AGwEÅïýˆ'”%È
dbc
------------------------------------------------------
PACKET FROM SERVER TO CLIENT
PacketID:4<>127.0.0.1 ----> 127.0.0.1---- Size:610
bUFLŒê�*Š..Ðýñ*ît0¦Ñíã‘ÓªH*„]Â…¼ îã¸O¹i/‡ýªÛ¦ÑËMÈ=9øA‚ô–‘}ý0‚ù0‚b*ƒ �—áˆOU‘™˜ÝÂ…0 *†H†÷0;1907U0SSL_Self_Signed_Fallback01 00912034816Z400912034816Z0;1907U0SSL_Self_Si gned_Fallback0�Ÿ0 *†H†÷��0�‰��´êʾÐöõЬ˜ëÝô|99XP¢°ü¸¨©q8r¨ ¥À%lcß HT1§“iï/®T�Œ ’‘)r+¸åÈÕý‰dh%MWq0>ñÿn*�޹M°³UµàãÖ~箘¬‚x*ê—`.F?«%Ì@5àFm{r¸–l©ª›0 *†H†÷��\!%ÏʈPÒ‘.›)ùé´#Cë;ðî.:ƒñ©âŒ¨dQ¨g�„eVS9§O»¾¶ÆÐøb ÒŠ¹òU_:Jø"ƒI��9ãzYQx–í‚§×A_fǤØY$¸óD£Bî:ËéݳÐwFµ Ùãt‚.È��l igKÑàL”
------------------------------------------------------
PACKET FROM CLIENT TO SERVER
PacketID:5<>127.0.0.1 ----> 127.0.0.1---- Size:190
¾†‚€+c§‘~0³bðäygZÄ®¦N}\8]‹áâ}Ä)ÞS ²q�¡vHŽt�ªHØwTEŒoíEécC
a'zƒî�K§£öÁ+qêÑ©EÀ%°1#ý~PÂô%_ÜñÛPé¥(÷É$>
ÉÖE9g«Ø;¢GËÒç ˆYEž×N¡~`Ågj¨r¾ÐÞƒð*Ë܇(%é¹¶–
------------------------------------------------------
PACKET FROM SERVER TO CLIENT
PacketID:6<>127.0.0.1 ----> 127.0.0.1---- Size:51
3 U›>î÷Ò’§ý55‰}{ü žA`þ`ã‰ÔR×Ý'¯@
------------------------------------------------------
PACKET FROM CLIENT TO SERVER
PacketID:7<>127.0.0.1 ----> 127.0.0.1---- Size:199
Â{jŒÆçGK±%¼qÌÄ�у
Á L@]5K$Òa›p:RÚ- ³jÔ†…Ý‘z—¯FïÇŽ)¾ÂY×Ñ[Æ>§^jžÒ™47ó9PÚ”êqjA¸Æ{¥°Ê—�Nœ¢æX-þ}JÔÛ�Ѫ®Ú L¦^ô,?^ß]Ì«f?]æ>Z?*£6I-(»Ft\™ñv‰ét7ŒTX£¶Z!7¥v¿Š‚�ƒ‹Íêu`yŒŽ‚ã톿“æÑSLqìª,v
------------------------------------------------------
PACKET FROM SERVER TO CLIENT
PacketID:8<>127.0.0.1 ----> 127.0.0.1---- Size:421
¥3ã#
Telecastermaster«|E)Changed database context to 'Telecaster'.VMPC\SQLEXPRESSãÐã
us_english«xG'Changed language setting to us_english.VMPC\SQLEXPRESS*6qMicrosoft SQL Server
@ã40964096ý
------------------------------------------------------
In our case: CLIENT=CaptainHerlock and SERVER=SQL
------------------------------------------------------
then i get the error message from GS:''[DBNETLIB][ConnectionOpen(Connect()). Access Denied or SQL Server does not exists.''