iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
MySQL’s classic client-server protocol normally uses TCP port 3306. On Ubuntu, the basic UFW rule is sudo ufw allow 3306/tcp, but that only permits packets through the host firewall. MySQL must also be configured to listen for network connections, and the safest rule limits access to your application server or private subnet rather than the entire internet.
What port 3306 is—and what opening it actually does
Port 3306 is the default TCP port for MySQL’s classic protocol. The number is a default, not a guarantee: an administrator can configure MySQL to use another port. Check the running server from a MySQL session before writing the firewall rule:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →SHOW VARIABLES LIKE 'port';Use the returned value in the UFW rule if it is not 3306. UFW controls packet filtering at the operating-system level. It does not start MySQL, change MySQL’s bind address, create database users, or override an upstream cloud security group, router ACL, or another host firewall.
Ubuntu describes UFW as its default firewall configuration tool. Its command interface is intentionally aimed at adding and removing simple rules, rather than replacing every capability of a full firewall-management system.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Choose the narrowest access scope first
Before changing UFW, decide which machines genuinely need to connect. A public database port is a much larger exposure than a rule restricted to one application server.
| Rule scope | When it fits | Security and operational trade-off |
|---|---|---|
| Anywhere | Temporary diagnostics or a design in which every source is intentionally permitted | Easiest to connect to, but exposes the MySQL listener to every reachable source; it requires the strongest compensating controls and careful monitoring |
| One IP address | A single application server, administration host, or other known client | Smallest practical network scope; breaks when the client’s address changes unless the rule is updated |
| Private subnet | Several trusted systems on the same private network | Convenient for a cluster or application tier, but every host in that subnet becomes an allowed source |
| Specific interface | A host with multiple network interfaces where MySQL should be reachable only through one path | Reduces accidental exposure on another interface; requires you to know the correct interface and routing |
Use a stable private address, subnet, or controlled network path where possible. If the application server receives a new address from DHCP or an autoscaling system, a single-IP rule can become stale and cause an apparently unexplained outage.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteOpen TCP 3306 with UFW
1. Check the current firewall state
Inspect existing policy and rules before adding anything:
sudo ufw status verbose
sudo ufw status numberedstatus verbose shows the active policy and rule details. status numbered adds rule numbers, which are useful when you later need to remove one specific entry.
2. Add the basic MySQL rule
For a server that should accept MySQL TCP traffic from any source permitted by the surrounding network, run:
sudo ufw allow 3306/tcpThe explicit /tcp matters. MySQL’s classic protocol uses TCP, so allowing only the required protocol is clearer and narrower than allowing every protocol on that port. UFW records this as an allow rule for destination port 3306.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
3. Verify the resulting rule
Immediately check the rule list again:
sudo ufw status numberedConfirm that the rule shows TCP and the expected destination port. If you intended a source restriction, do not proceed until the displayed source and destination match your design.
4. Enable UFW safely on a remote server
UFW is initially disabled on Ubuntu installations. Enabling it can cut off your current administration session if SSH is not already allowed. From an existing console or SSH session, permit SSH first when necessary:
sudo ufw allow ssh
sudo ufw enable
sudo ufw status verboseIf your SSH service uses a nonstandard port, allow that actual port instead of relying on the service name. Keep an active session available while enabling the firewall so you can verify connectivity before closing it.
Use a source-restricted rule for an application server
Allow one known client
Replace 203.0.113.10 with the real source address of the application server:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo ufw allow from 203.0.113.10 to any port 3306 proto tcp comment 'MySQL from app server'The from clause limits the source, to any port 3306 identifies the destination port, proto tcp limits the protocol, and the comment makes the purpose visible during later audits. The address in this example is documentation-only; do not leave it in place unless it is actually the client that should connect.
Allow a trusted private subnet
For clients in a private network such as 10.20.0.0/16, use:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo ufw allow from 10.20.0.0/16 to any port 3306 proto tcp comment 'MySQL private network'Use the smallest subnet that contains all required clients. A broad private range can unintentionally include development, test, or unrelated hosts.
Consider interface scope when the host has multiple paths
UFW supports interface-qualified rules in addition to source, destination port, and protocol conditions. This is useful when a database server has a public interface and a private interface and the database should be reachable only through the private path. Confirm the interface name and routing on the host before applying an interface-specific rule; a typo or renamed interface can make the rule ineffective.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why source restriction is preferable
An unrestricted allow rule makes every network source that can route to the host a candidate for a MySQL connection attempt. A one-address or private-subnet rule reduces that reachable set and leaves a clear audit trail. Source restriction does not replace MySQL authentication, encryption, patching, or network segmentation; it is one layer of control.
Make sure MySQL is listening for remote TCP connections
If the firewall rule is correct but a remote client still cannot connect, check the MySQL listener. Opening a port in UFW cannot make a service listen where it is not configured to listen.
Check the bind address
MySQL’s troubleshooting documentation notes that bind_address=127.0.0.1 restricts the server to loopback. A process configured this way accepts local connections but does not accept connections arriving from another machine. The server must be configured with an address that is reachable from the intended client, or with the package’s appropriate all-interface setting, according to your security design.
Check whether TCP networking is disabled
The skip_networking option prevents TCP/IP connections. If it is enabled, a UFW rule for port 3306 has nothing to forward to because MySQL is not accepting network TCP traffic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Apply configuration changes using the installed package procedure
After changing MySQL’s network settings, restart MySQL using the service procedure supplied by the Ubuntu/MySQL packages installed on that host. Then verify the configured port again with SHOW VARIABLES LIKE 'port'; and test a TCP connection. Avoid assuming that a configuration-file edit took effect until the running server confirms the setting.
Separate network failures from database authorization failures
A successful TCP connection only proves that packets reached MySQL and that the server completed the network handshake. Invalid credentials, a user account that is not permitted from the connecting host, or database privileges can still reject the login afterward. Diagnose the transport first, then investigate MySQL authentication and authorization separately.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test the correct transport
MySQL clients on Unix commonly treat localhost as a request for a Unix-domain socket. That path can succeed even when TCP port 3306 is blocked or MySQL is bound only to loopback. A local login using mysql --host=localhost therefore does not prove that remote TCP access works.
Test from the application or another remote host
Force TCP and specify the database server’s reachable address:
mysql --host=DB_SERVER_IP --protocol=TCP --port=3306 -u USER -pReplace DB_SERVER_IP and USER with the real values. The password is requested interactively by -p; it is not exposed in the command line.
Test TCP locally on the database server
Use the loopback address rather than the name localhost:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
mysql --host=127.0.0.1 --protocol=TCP --port=3306 -u USER -pMySQL documents that the --port option is ignored for a Unix-socket localhost connection unless TCP is explicitly forced. This test distinguishes a functioning TCP listener from a socket-only login.
Interpret common test outcomes
- Connection refused: the host is reachable, but no permitted service is accepting the requested address and port. Check that MySQL is running, the port matches its configured value, and the bind address permits that path.
- Connection timed out: traffic is commonly being dropped by UFW, an upstream security group, a router, or another network control. Check each filtering layer.
- Access denied after a prompt: the TCP path is working; investigate the username, password, account host restrictions, and database privileges.
- Localhost succeeds but the remote test fails: the local command may have used a Unix socket. Repeat with
127.0.0.1and--protocol=TCP, then inspect binding and firewalls.
Inspect, remove, and revise UFW rules
Review active policy and rule order
Use both verbose and numbered status output when diagnosing a rule:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sudo ufw status verbose
sudo ufw status numberedRule order and overlapping entries matter during troubleshooting. Look for an unintended broad rule, a source address that does not match the client, or a rule that names a different port or protocol.
Delete a rule by reproducing it
For the unrestricted rule, UFW supports:
sudo ufw delete allow 3306/tcpFor a source-limited rule, reproduce its complete defining clauses when deleting it so UFW can identify the intended entry. This is safer than guessing when several MySQL rules exist.
Delete by displayed rule number
After reviewing status numbered, you can remove a specific entry with:
sudo ufw delete RULE_NUMBERReplace RULE_NUMBER with the number shown by UFW. Rule numbers can change after deletions, so recheck the list after each change.
Recommended Free Tools
Work through a remote-connection failure in order
- Confirm the server is running. A stopped MySQL service cannot accept traffic regardless of firewall state.
- Confirm the port. Run
SHOW VARIABLES LIKE 'port';in a MySQL session and compare the result with the UFW destination port. - Confirm network settings. Ensure
bind_addressis not limited to127.0.0.1when remote access is required, and ensureskip_networkingis not disabling TCP. - Confirm the transport test. Use
--protocol=TCPand an IP address; do not rely on a successful socket-basedlocalhostlogin. - Confirm UFW. Review verbose and numbered status output for the expected source, port, protocol, and any conflicting policy.
- Check upstream controls. A cloud security group, virtual network ACL, router, hosting firewall, or second host firewall can drop traffic before it reaches UFW.
- Check the client address. A source-restricted rule fails if the application connects through a different address, NAT gateway, proxy, or interface than expected.
- Only after transport works, check MySQL authorization. Credentials and account host permissions are a separate layer from packet filtering.
Change one layer at a time and retest. That preserves a clear cause-and-effect trail and avoids widening several controls simultaneously.
Quick Recap
Operational and security checks after the change
- Keep the rule protocol-specific: MySQL’s classic service needs TCP, not every protocol.
- Prefer a single application-server address or the smallest private subnet that meets the design.
- Use comments that identify the owning application or purpose so an administrator can audit the rule later.
- Record whether the address is static. If it changes, update the rule deliberately rather than opening the port to all sources as a permanent workaround.
- Protect the database with MySQL authentication and appropriate account privileges even when UFW is source-restricted.
- Review cloud and network firewalls in addition to the operating-system firewall.
- When removing temporary access, verify the numbered rule list after deletion and test that the intended client is no longer able to connect.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
