Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To make MySQL local-only on an Ubuntu VPS, set bind-address = 127.0.0.1 in /etc/mysql/mysql.conf.d/mysqld.cnf under [mysqld], restart MySQL, and verify that it listens only on loopback. Then deny inbound TCP port 3306 in UFW and in any firewall or security group supplied by your VPS provider.
This closes the public network path while preserving local Unix-socket access for applications running on the same server. If an application on another machine genuinely needs the database, use a private interface and source-restricted firewall rule instead of exposing MySQL on every interface.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What disabling remote access changes
MySQL accepts TCP connections on the addresses specified by its bind_address setting. A wildcard listener such as 0.0.0.0:3306 or [::]:3306 can receive traffic through the VPS’s network interfaces. Setting the address to 127.0.0.1 limits TCP connections to the server’s loopback interface, so a client on another host cannot connect through the network.
The change affects TCP networking, not necessarily local socket connections. A web application running on the same VPS can usually continue to connect through MySQL’s Unix socket. A remote client, however, will fail at the network connection stage when no externally reachable listener or firewall path remains.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
| Listener or setting | Who can reach it | Meaning |
|---|---|---|
0.0.0.0:3306 |
Any IPv4 interface allowed by the firewall | MySQL is listening on all IPv4 addresses. |
[::]:3306 |
Any IPv6 interface allowed by the firewall | MySQL is listening on all IPv6 addresses; depending on the system, IPv4 behavior can also be affected. |
127.0.0.1:3306 |
Only processes using the VPS loopback interface | Remote TCP access is disabled at the MySQL listener. |
skip_networking |
No MySQL TCP/IP clients | TCP/IP networking is disabled entirely; local socket access can remain available. |
MySQL’s reference documentation describes bind_address=127.0.0.1 as accepting TCP/IP connections only through loopback. It also documents skip_networking as the more restrictive setting that disables TCP/IP networking altogether.
Check your VPS before making the change
Identify which clients use MySQL
First determine whether every database client runs on the VPS. A same-server PHP, Python, Node.js, or other application can use a local socket or loopback TCP. A separate application server, worker, reporting host, monitoring system, or administrator’s desktop may currently use the VPS’s address and port 3306. Binding to loopback will stop those remote clients immediately.
If a second host needs access, record its private address and the network path between the machines before changing the listener. The safer replacement is a private bind address plus a firewall rule that names only the required source, described later in this guide.
Inspect the current listener
Run this command with root privileges:
sudo ss -lntp | grep -E 'mysql|3306'Interpret the address in the result. 0.0.0.0:3306 and [::]:3306 indicate listeners on network interfaces; 127.0.0.1:3306 indicates an IPv4 loopback-only listener. If the command returns no line, MySQL may be stopped, may use a different port, or may not expose a TCP listener.
Set MySQL to listen only on loopback
1. Edit the Ubuntu server option file
For an Ubuntu package installation, open:
sudo editor /etc/mysql/mysql.conf.d/mysqld.cnfLocate the [mysqld] section. Add or change the setting there:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
[mysqld]
bind-address = 127.0.0.1Keep the option in the server section, not in a client section such as [client]. If the file already contains another active bind-address line, replace it rather than leaving conflicting active entries. Save the file and exit the editor.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallbind_address is a startup setting. Editing the file does not alter an already-running server; MySQL must be restarted before the new address takes effect.
2. Restart MySQL
sudo systemctl restart mysql.serviceA successful command normally produces no output. Immediately check the service state if you want an explicit result:
sudo systemctl status mysql.service --no-pagerThe service should show as active (running). Do not proceed on the assumption that the setting applied if the restart failed.
3. Inspect the journal if the restart fails
Read the service log:
sudo journalctl -u mysqlA common configuration mistake is binding to an address that is not assigned to the VPS. The loopback address 127.0.0.1 should exist on every normal IPv4 host, but a private-address configuration must match an address actually present on the server. Correct the option, save the file, and restart again. Also check for syntax errors or an accidentally edited section outside [mysqld].
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
4. Confirm the listener after the restart
sudo ss -lntp | grep mysqlThe expected TCP result is a MySQL process bound to 127.0.0.1:3306. If you still see 0.0.0.0:3306, [::]:3306, or another externally assigned address, the effective configuration has not been restricted. Recheck the file path, duplicate settings, included option files, and the restart result before testing the firewall.
Close port 3306 in the firewall
UFW on the VPS
Changing MySQL’s bind address prevents the daemon from accepting remote connections, but firewall rules should still deny unsolicited traffic. If UFW is enabled, inspect its numbered rules:
sudo ufw status numberedRemove any broad allow rule for MySQL if one exists, then deny inbound TCP 3306:
sudo ufw deny 3306/tcpUse the numbered status output to verify the resulting policy. A prior rule allowing 3306 from anywhere can be broader than the new deny, depending on rule order; remove or narrow that allow rule rather than assuming the deny is effective. UFW supports source-specific rules, so if a later design requires remote access, permit only the required private source instead of reopening the port globally.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsProvider firewall or security group
VPS platforms often apply an external firewall, security group, or network access list outside the operating system. Review that control panel and remove any inbound TCP 3306 rule that permits the public internet. A host-level deny does not compensate for a mistakenly broad provider rule in your security design, and an external rule can also explain why a port appears reachable during testing.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Test local and remote behavior
Test from the VPS
A local Unix-socket connection may continue to work after remote TCP is disabled. Test the same connection method your application uses, without changing its credentials or host setting unnecessarily. A local TCP test to 127.0.0.1:3306 should also work when MySQL is healthy and listening on loopback.
Successful local access proves that the server is running; it does not prove that an external interface is closed. Pair the application test with the ss listener check and firewall review.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test from another host
From a machine outside the VPS, perform a TCP connection test to the VPS address and port 3306 using the diagnostic tool available on that machine. With loopback binding and a deny rule in place, the attempt should fail or time out. A refusal can indicate that the host is reachable but no process accepts the connection; a timeout commonly indicates filtering somewhere in the path. Either outcome is consistent with preventing database access, but the listener and firewall checks identify which control is responsible.
Do not treat a MySQL authentication error as proof that the port is blocked. An authentication error means a TCP connection reached MySQL far enough for the server to respond. MySQL’s connectivity guidance recommends checking the listening address and firewall or iptables rules when diagnosing connection problems.
When to use skip_networking instead
skip_networking disables MySQL TCP/IP networking entirely. It is appropriate when every client is local and you want the server to have no MySQL TCP listener at all. Local Unix-socket access can remain available, so an application configured for the socket may continue working.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
This setting is less flexible than loopback binding. It also prevents local applications that explicitly connect to 127.0.0.1 over TCP, even though they run on the same VPS. Choose it only after confirming that local clients use a socket or can be changed to do so. If you need local TCP compatibility, keep bind-address = 127.0.0.1 and enforce the firewall deny instead.
If another machine genuinely needs MySQL
Do not switch back to 0.0.0.0 simply because a multi-host application stopped connecting. MySQL’s secure-deployment guidance recommends binding to a specific IPv4 or IPv6 address so the server accepts TCP/IP connections only on that address.
| Design | Network exposure | Source restriction | Transport | Operational complexity |
|---|---|---|---|---|
| Same-host application | Loopback only | None beyond local access | Unix socket or loopback TCP | Lowest; one VPS |
| Private application network | Private interface address | Application host or private subnet only | Private network; add TLS where required | Moderate; coordinate addresses and rules |
| Administrative or cross-network access | Keep MySQL off the public interface | SSH tunnel or VPN endpoint | Encrypted tunnel or VPN | Higher; manage tunnel users, keys, and routing |
| Public-interface binding | Public network interface | Potentially broad | Requires strict firewall and transport controls | Highest risk and maintenance burden |
Bind to the private address
Find the address on the interface used by the application network, then set that exact address as bind-address under [mysqld]. Restart MySQL and confirm with ss that the listener appears on the private address rather than a wildcard. The address must remain assigned to the VPS; if interface configuration changes, MySQL may fail to start until the setting is corrected.
Restrict the firewall source
Permit TCP 3306 only from the application host’s private address or the narrowly defined private subnet. Keep public-interface access denied in both UFW and the provider firewall. A private bind limits where MySQL listens; the source-restricted firewall limits which machines can reach that private listener.
Use a tunnel or VPN for occasional access
An SSH tunnel or VPN can carry database traffic without publishing MySQL on the public interface. Exact commands depend on your provider, network topology, identity system, and local client, so configure the tunnel endpoint and authentication according to those details. The key design goal is that MySQL listens on loopback or a private interface while the tunnel supplies controlled access.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Troubleshooting by symptom
The remote connection still succeeds
- Run
sudo ss -lntp | grep -E 'mysql|3306'on the VPS. A wildcard or public address means MySQL is still exposed on that interface. - Confirm that the edited file is
/etc/mysql/mysql.conf.d/mysqld.cnffor the Ubuntu package installation and that the option is under[mysqld]. - Restart with
sudo systemctl restart mysql.service; the setting is not applied to an existing process until restart. - Check both UFW and the provider firewall for an allow rule. A firewall rule cannot make a wildcard listener local-only; it is an additional control.
The application stopped connecting on the same VPS
- Check whether it connects through a Unix socket or to a TCP host and port.
- If it uses a TCP host other than
127.0.0.1, change it to the loopback address or to the local socket appropriate for your installation. - If you enabled
skip_networking, switch back to loopback binding when the application requires local TCP. - Verify that MySQL is active with
sudo systemctl status mysql.service --no-pagerand inspectsudo journalctl -u mysqlfor startup errors.
The restart fails
- Read
sudo journalctl -u mysqland correct the reported configuration or address problem. - Ensure the configured private address belongs to an active VPS interface.
- Check for malformed text, duplicate active options, or a setting placed outside the
[mysqld]section. - Restore the last known-good value, restart, and then make one controlled change at a time.
The remote test times out, but you need to know why
Compare the three controls independently: the ss output shows where MySQL listens, UFW shows the host firewall decision, and the provider firewall shows the external network decision. A timeout alone cannot identify which layer dropped the packet. An authentication error, by contrast, indicates that the request reached MySQL and should be investigated as an account or credential problem rather than a blocked listener.
Rollback procedure
If a dependent service requires remote access, edit the same option file and replace the loopback value with the approved private IPv4 or IPv6 address, then restart MySQL. Confirm the new listener with ss. Reopen TCP 3306 only for the required application source in UFW and the provider firewall; do not restore a global allow rule unless that exposure is an intentional, documented decision.
Quick Recap
Final verification checklist
/etc/mysql/mysql.conf.d/mysqld.cnfcontains the intendedbind-addressunder[mysqld].sudo systemctl restart mysql.servicecompleted successfully.sudo ss -lntp | grep mysqlshows127.0.0.1:3306for a local-only design, or the approved private address for a multi-host design.- UFW has no broad inbound allow for TCP 3306 and reflects the intended deny or source restriction.
- The VPS provider’s firewall or security group denies public TCP 3306.
- The local application works through its intended socket or loopback connection.
- A TCP test from an unauthorized external host fails or times out, while an approved private client works only when remote access is deliberately required.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
