Port 3306 Is Open: How to Lock Down Remote MySQL

When you move a database onto its own server, the web servers have to reach it over the network. The quickest way to make that work is to open port 3306, MySQL's default, and allow a list of IP addresses. It works, everyone moves on, and nobody looks at that list again.

A year later, the list has grown, some of the addresses belong to servers you no longer run, and MySQL may be listening on every interface, including the public one. This guide shows how to check, how to close the gap and how to set it up so the database is reachable only over a private network. It pairs well with our 30-minute server access audit.

Why an open 3306 is a problem

Internet-wide scanners look for open database ports constantly. Once they find one, they try common usernames and passwords, known vulnerabilities and weak authentication settings.

The firewall list is the only thing in the way. If MySQL listens publicly, any mistake in the allowed list exposes the database.

Allowed lists go stale. Addresses get added to fix an urgent problem and never removed. Some may now belong to someone else entirely.

Database accounts are often too broad. A user created as 'app'@'%' can log in from anywhere the network allows.

None of this needs a sophisticated attacker. It needs one forgotten rule.

The quick check

1. See what MySQL is listening on. On the database server, run:

ss -tlnp | grep 3306

If you see 0.0.0.0:3306, *:3306 or [::]:3306, MySQL is listening on every network interface. If you see 127.0.0.1:3306 or a private address such as 10.x.x.x, it is limited to that interface.

2. Look at the firewall rules for port 3306. Depending on your setup, that might be iptables -S | grep 3306, nft list ruleset | grep 3306, firewall-cmd --list-all, or the firewall screen in your control panel. Ask whether you still recognise every address.

3. Check which accounts can connect from where. In MySQL, run:

SELECT user, host FROM mysql.user;

Any account with a host of % can connect from any address the network allows.

If you would rather engineers handled this kind of hardening, it is part of the managed services included on every InMotion Cloud plan.

How to lock it down

Remove any allowed address you cannot name. If nobody can say what an address is for, take it out of the firewall rule. If something breaks, you will find out quickly and can add it back with a note saying why.

Bind MySQL to a private interface. In the MySQL configuration file, often /etc/mysql/mysql.conf.d/mysqld.cnf or /etc/my.cnf, set bind-address to the server's private IP address, then restart MySQL. If your web servers and database are on the same machine, 127.0.0.1 is enough.

Tighten database accounts. Replace 'app'@'%' with an account limited to your web servers' private addresses, such as 'app'@'10.0.0.%', and give it only the privileges the application needs.

Close the port to the public internet entirely. Once database traffic runs over the private network, the firewall rule for 3306 on the public interface can be removed rather than maintained.

Encrypt connections if traffic crosses a network you do not control. MySQL supports TLS connections, and you can require them for specific accounts.

A note for control panel users

If your servers run cPanel or another control panel, remote MySQL access is often managed through the panel rather than by editing files directly. Use the panel's remote database settings and firewall screen where you can, so the panel does not overwrite your changes later.

One thing to do this month

Run the three checks above on every database server you have. Remove any address you cannot name. If your servers can already talk over a private network, move database traffic onto it and close the public port. Our guide to firewall rules and security groups covers how to write rules that deny by default.

How InMotion Cloud handles this

On InMotion Cloud, your servers can share a private network with internet access for the parts that need it, so database traffic never touches the public internet. Access is controlled with security groups: rule sets defined once and applied to every server in a role, so the database rule says "allow 3306 from the web servers" rather than listing addresses by hand.

You still own your database accounts and what your application is allowed to do. Our engineers can help you set up the private network and the rules.

Summary

An open port 3306 is usually the result of a quick fix that never got revisited. Check what MySQL listens on, who the firewall allows and which accounts can connect from anywhere. Remove what you cannot name, move database traffic onto a private network and close the port to the public internet.

Frequently asked questions

Is it safe to leave port 3306 open? Not to the public internet. Scanners look for open database ports constantly. Limit access to a private network or, at minimum, a short list of known addresses.

How do I check if MySQL is listening publicly? Run ss -tlnp | grep 3306 on the database server. 0.0.0.0:3306 or *:3306 means it is listening on every interface.

What should bind-address be set to? The private IP address your web servers use to reach the database, or 127.0.0.1 if the database and web server are on the same machine.

Does changing the port from 3306 make MySQL secure? No. It reduces some automated noise, but scanners check other ports too. Restrict who can connect instead.