Port reference
Port 3306 (TCP) – MySQL / MariaDB
Default listener for MySQL and MariaDB relational database connections.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Modern packages bind to localhost (127.0.0.1) by default, but many deployments set bind-address to 0.0.0.0, exposing 3306 across the network or to the internet.
What is port 3306 used for?
Port 3306 is the default TCP port for MySQL and its compatible fork MariaDB, two of
the most widely used relational databases. Application servers and admin tools — web
apps, WordPress, and clients like MySQL Workbench, DBeaver, or the mysql
command line — connect over 3306 to run SQL queries against databases that power
websites, SaaS products, and internal apps.
When would you open it?
You open 3306 when an application or admin tool on another machine needs to reach your MySQL/MariaDB server. Common cases are a separate web server connecting to the database; otherwise it stays bound to localhost. Allow it only to the specific trusted hosts that need it, ideally over a private network.
Is it safe to open?
Databases on 3306 are heavily scanned and brute-forced, and an exposed one can mean full data theft. Keep it bound to localhost or a private network, use strong passwords, require TLS, and reach it over a VPN or SSH tunnel. See the security notes below.
How to check if this port is open
ss -tulpn | grep :3306
nmap -p 3306 <target>netstat -ano | findstr :3306
Test-NetConnection <host> -Port 3306lsof -i :3306
nmap -p 3306 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 3306 to your device's local IP, internal port 3306, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 3306/tcpsudo firewall-cmd --permanent --add-port=3306/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3306 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 3306" -Direction Inbound -Protocol TCP -LocalPort 3306 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against root and app accounts
- Exploitation of empty or default passwords
- Privilege abuse and FILE-based data exfiltration after login
- SQL injection pivoting into the database engine
Hardening
- Bind to localhost or a private interface; never expose 3306 to the internet
- Remove anonymous and empty-password accounts (run mysql_secure_installation)
- Enforce strong passwords, least-privilege grants, and host-scoped users
- Require TLS for client connections and segment with firewalls
- Keep MySQL/MariaDB patched and monitor failed logins
How to block this port
sudo ufw deny 3306/tcpsudo firewall-cmd --permanent --remove-port=3306/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3306 -j DROPNew-NetFirewallRule -DisplayName "Block 3306" -Direction Inbound -Protocol TCP -LocalPort 3306 -Action Blocknmap snippet
nmap -p3306 --script mysql-info,mysql-empty-password <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is it safe to expose port 3306 to the internet?
- No. Internet-facing MySQL is constantly scanned and brute-forced. Bind to localhost or a private network and connect over a VPN, SSH tunnel, or TLS.
- Why does my MySQL listen on 0.0.0.0?
- Because bind-address was set to 0.0.0.0, often to allow remote app servers. Restrict it to a private interface and firewall the port to trusted hosts only.