Restricting MySQL port access

This guide explains two methods to restrict or block access to MySQL port 3306 on an unmanaged server.

Important: You must have root access to the server. This guide applies only to unmanaged products.

Method 1: Disable MySQL Networking

If you do not need external access to MySQL, you can disable networking.

Tip:

Even with networking disabled, you can still access MySQL securely from a remote computer using an SSH tunnel.

AlmaLinux and Fedora

1. Log in to your server via SSH.
2. Open the MySQL configuration file /etc/my.cnf with your preferred text editor.
3. Locate this line:

#skip-networking

Note: If the line does not exist, add it.

4. Remove the # so it reads:

skip-networking

5. Save the file and exit the editor.
6. Restart MySQL:

service mysqld restart

Port 3306 is now closed to external connections.

Debian and Ubuntu

1. Log in to your server via SSH.
2. Open /etc/mysql/my.cnf with your text editor.
3. Locate the bind-address line:

bind-address = 127.0.0.1

Note

• If bind-address is set to 0.0.0.0 or missing, MySQL is open to all interfaces.
• 127.0.0.1 restricts connections to localhost only.

4. Save any changes and exit.
5. Restart MySQL:

service mysql restart

Port 3306 is now restricted to local connections.

Method 2: Configure Firewall Rules

You can use iptables to selectively block or allow access to port 3306.

• Block all external access:

iptables -A INPUT -p tcp --dport 3306 -j DROP

• Allow a specific IP and block others (replace xxx.xxx.xxx.xxx with the allowed IP):

iptables -A INPUT -p tcp --dport 3306 -s xxx.xxx.xxx.xxx -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

Tip:

To allow additional IPs, insert rules before the DROP rule:

iptables -I INPUT 1 -p tcp --dport 3306 -s xxx.xxx.xxx.xxx -j ACCEPT

This method provides granular control over which IPs can connect to MySQL.