Is it safe to open port 3306 to the public internet?

No. Exposing database ports creates immediate vulnerability to credential attacks and data exfiltration. Use SSH tunneling or internal private networking instead.

How do I configure MySQL to only listen on localhost?

Edit your MySQL configuration file (my.cnf) and set 'bind-address = 127.0.0.1', then restart the MySQL service.

How do I check if my port 3306 is exposed?

Enter your public IP address into our Open Port Checker tool. If it reports port 3306 as OPEN, your firewall needs immediate remediation.

Home/Open Port Checker/Port 3306

Port 1433 Port 3389

Registered Port Reference

Port 3306: MySQL / MariaDB (TCP)

Default relational database listener for MySQL and MariaDB database instances.

Port Number

3306

Transport

TCP

Security Risk

Critical

Standard / RFC

MySQL Protocol

Test Port 3306 Reachability Live

Verify whether Port 3306 is open, closed, or filtered on your server or public IP address.

Loading port checker...

Service Architecture & Function

Port 3306 is the standard TCP port for MySQL and MariaDB database servers. Web applications (WordPress, Laravel, Node.js microservices) connect to port 3306 to execute SQL queries and manage relational datasets.

Security Profile & Hardening

Exposing MySQL on port 3306 to the public internet invites automated dictionary brute-force attacks against the 'root' user and potential remote exploit injection. Always bind MySQL to localhost (127.0.0.1) or an internal private IP.

Example Firewall Commands:

# UFW (Ubuntu/Debian)

sudo ufw allow from 10.0.0.0/8 to any port 3306 proto tcp

# iptables (Direct Kernel)

iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 3306 -j ACCEPT