Port 3306: MySQL / MariaDB

What uses port 3306

MySQL and MariaDB servers accept client connections on TCP 3306, as do Amazon RDS/Aurora MySQL, PlanetScale and TiDB-compatible services. MySQL X Protocol (used by MySQL Shell and Document Store) runs on 33060. On a fresh install the server often listens only on localhost, which is the right default.

Should port 3306 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Remote connection refused? Check bind-address in my.cnf (127.0.0.1 means local only), the firewall, and that the user is allowed from your host ('user'@'%' vs 'user'@'localhost').
• Host ... is not allowed to connect to this MySQL server is a grant problem, not a network problem.
• Never expose 3306 to the internet. Use an SSH tunnel (ssh -L 3306:localhost:3306 user@db-host) or a private network.

Check what is listening on port 3306

sudo ss -ltnp 'sport = :3306'

sudo lsof -nP -iTCP:3306 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 3306 -State Listen
netstat -ano | findstr :3306

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 3306

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:3306 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 3306 -State Listen).OwningProcess

Allow port 3306 from trusted networks only

The examples allow 3306 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 3306 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 3306 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "MySQL / MariaDB 3306/TCP" -Direction Inbound -Protocol TCP -LocalPort 3306 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 3306 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 3306:3306 would expose the port to the whole network.
docker run -d -p 127.0.0.1:3306:3306 mysql

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 3306 from another machine

nc -zv example.com 3306

Test-NetConnection example.com -Port 3306

Related ports

• Port 5432 (PostgreSQL): the default port for PostgreSQL.
• Port 1433 (Microsoft SQL Server): the default port for Microsoft SQL Server.
• Port 6379 (Redis): the default port for Redis and Valkey.

More databases ports

1434 (SQL Server Browser) , 1521 (Oracle Database) , 8086 (InfluxDB) , 9042 (Cassandra / ScyllaDB) , 9200 (Elasticsearch / OpenSearch) , 9300 (Elasticsearch transport) , 11211 (Memcached) , 27017 (MongoDB) . See all ports in the port lookup.

Sources

• IANA port registry: 3306

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions