Port 3306: MySQL — Complete Guide

Port 3306 is reserved by IANA for the MySQL service. MySQL database. Never expose on public IP — use SSH tunnel or private VPC only.

To find out if port 3306 is open on your host (or a third-party's — for diagnostics), use our port checker. Enter a domain and a port number — results arrive in 1-2 seconds.

Check port 3306 →

An open port is a potential attack vector. General rules:

• Close everything you don't use (firewall default-deny)
• For admin ports (22 SSH, 3389 RDP, 3306 MySQL) — IP whitelist or VPN
• Base cases: 80+443 open for web; 22 — from work/VPN only; DB ports — loopback only
• Use fail2ban for SSH/admin panels

Port 3306, the default port for MySQL, is a common target for attackers due to its widespread use. Exposing this port to the public internet can create significant security vulnerabilities, allowing unauthorized access to your database. Attackers may exploit weak passwords, unpatched vulnerabilities, or configuration errors to gain access.

To mitigate these risks, consider the following security measures:

• Restrict IP Addresses: Limit access to port 3306 to specific IP addresses using firewall rules. This can be configured in your cloud provider's security settings or through local firewall configurations.
• Use Strong Passwords: Ensure all MySQL user accounts have strong, unique passwords to prevent brute-force attacks.
• Enable SSL Connections: Encrypt data in transit by configuring MySQL to require SSL connections. This protects sensitive information from being intercepted.
• Regularly Update MySQL: Keep your MySQL server updated to the latest version to patch known vulnerabilities.

By implementing these security practices, you can significantly reduce the risk of unauthorized access to your MySQL database.

To verify if your MySQL server is actively listening on port 3306, you can use various command-line tools depending on your operating system.

Here are some practical commands:

• On Linux: Use the following command to check if MySQL is listening on port 3306:
sudo netstat -tuln | grep 3306
• If MySQL is running, you should see output similar to:
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN
• On Windows: Open Command Prompt and run:
netstat -ano | findstr :3306
• This will show you if the port is in use, along with the corresponding process ID.
• Using MySQL Client: You can also check the connection directly by executing:
mysql -u username -p -h localhost -P 3306
• If the connection is successful, it confirms that the service is running on that port.

In case you don't receive any output or an error occurs, it may indicate that MySQL is not running or listening on the specified port.

While port 3306 is the default for MySQL, changing it can enhance security by obscuring the database service from automated attacks targeting the default port. To configure MySQL to use a different port, follow these steps:

1. **Edit the MySQL Configuration File:** Open the MySQL configuration file, typically located at:

or

2. **Change the Port Number:** Locate the line that specifies the port:

Change it to your desired port, for example:

3. **Restart MySQL Service:** After saving your changes, restart the MySQL service to apply the new configuration:

or

4. **Update Firewall Rules:** Ensure that your firewall allows traffic on the new port:

5. **Connect Using the New Port:** When connecting to your database, specify the new port:

By following these steps, you can effectively change the port MySQL listens on, enhancing your database's security posture.