Port 3306 — MySQL (TCP)
What is Port 3306?
Porta predefinita per MySQL e MariaDB.
This is a registered port (1024–49151) often assigned to vendor or application services like MySQL. · No formal RFC; MySQL Client/Server Protocol
When do you need Port 3306 open?
Open only when an application on a different host must connect to MySQL. For single-server setups (app and database on the same machine), keep port 3306 closed externally and connect via a local socket or 127.0.0.1.
Common uses and software
- MySQL Server
- MariaDB
- Percona Server
- WordPress
- Drupal
- phpMyAdmin (backend)
- Laravel
- Django
Security
Bind MySQL to 127.0.0.1 by setting bind-address in my.cnf unless remote access is explicitly needed. Never expose port 3306 to the internet. For remote access, use an SSH tunnel: ssh -L 3306:localhost:3306 user@server. Grant privileges using least-privilege principles — avoid GRANT ALL and the root account for application connections.
Is Port 3306 safe?
An open port increases your attack surface. Safety depends on how MySQL is configured.
Keep MySQL up to date with security patches. Require strong authentication and restrict access to the minimum necessary IP addresses.
Test connectivity for Port 3306 on any host.
How to Open Port 3306
To allow incoming connections to Port 3306 (MySQL) from outside your network, configure your firewall and add a port forwarding rule on your router pointing to your device's local IP address.
Open Windows Defender Firewall → Advanced Settings → Inbound Rules → New Rule → Port → TCP → Specific local ports: 3306 → Allow the connection → Name and save the rule.
netsh advfirewall firewall add rule name="Open Port 3306" dir=in action=allow protocol=tcp localport=3306sudo ufw allow 3306/tcpsudo iptables -A INPUT -p tcp --dport 3306 -j ACCEPTLog into your router (192.168.1.1 or 192.168.0.1) → Port Forwarding → Add a new rule: Protocol TCP, External port 3306, Internal IP: your device's local IP, Internal port 3306 → Save.
How to close Port 3306
If you do not need MySQL, block this port in your firewall or router.
To block port 3306 on Windows, run the following command in PowerShell or Command Prompt (as Administrator):
netsh advfirewall firewall add rule name="Block Port 3306" dir=in action=block protocol=tcp localport=3306sudo ufw deny 3306/tcpsudo iptables -A INPUT -p tcp --dport 3306 -j DROPRemove or disable any port forwarding rule for Port 3306.
Frequently Asked Questions
What is Port 3306 used for?▾
Port 3306 is the default TCP port for MySQL. It is used by servers and applications that need to accept incoming connections for this service. Whether you need it open depends on whether you are actively running a MySQL server — if not, it should remain closed to reduce your attack surface.
Is Port 3306 safe to keep open?▾
An open Port 3306 increases your attack surface. If you are not actively running MySQL, close this port in your firewall and remove any port forwarding rules. If MySQL must be accessible, restrict access to known IP ranges, keep the service software updated with security patches, and use strong authentication.