Port 3306 – MySQL

TCP

Port 3306 is the default MySQL and MariaDB database port. Production databases should never expose port 3306 to the public internet – connections should come only from localhost or through SSH tunneling. Most security breaches involving databases occur because port 3306 is accidentally exposed.

Port Number

3306

Protocol

TCP

Service

MySQL Database

Range

IANA Registered (1024–49151)

Description

MySQL and MariaDB listen on port 3306 by default. The MySQL wire protocol is used for all client connections including mysql CLI, application drivers, and replication. For remote access, SSH tunneling (ssh -L 3306:localhost:3306) is the recommended approach rather than directly exposing the port.

Security risks

1Default root without password: fresh MySQL installations on some distros allow root login without a password from localhost. Run mysql_secure_installation immediately after install to set root password, remove anonymous users, and disable remote root login.
2Exposed to internet: Shodan indexes hundreds of thousands of MySQL instances on port 3306. Attackers brute-force credentials or exploit known CVEs (CVE-2012-2122 – auth bypass via repeated login). Bind to 127.0.0.1 in my.cnf (bind-address = 127.0.0.1).
3SQL injection via application: even when port 3306 is properly firewalled, SQL injection in the application layer gives attackers direct database access. Use parameterized queries and least-privilege database users (no GRANT ALL).
4Unencrypted replication: MySQL replication between master and replicas defaults to unencrypted. Binlog data (including all row changes) travels in cleartext. Enable require_secure_transport and configure SSL for replication channels.

Firewall guidance

Never allow inbound 3306 from 0.0.0.0/0. Application servers should connect via localhost (same host), private subnet (VPC), or SSH tunnel. Cloud databases (RDS, Cloud SQL) use security groups/firewall rules to restrict to application server IPs only. For developer access, use SSH tunneling or a bastion host with port forwarding.

Diagnosis commands

Test basic MySQL connectivity and authentication

shell

mysql -h host -P 3306 -u root -p -e 'SELECT 1'

Check MySQL server status (uptime, threads, queries)

shell

mysqladmin -h localhost -P 3306 -u root -p status

Verify which process owns port 3306 and what address it binds to

shell

ss -tnlp sport = :3306

Detect MySQL version remotely (should fail if properly firewalled)

shell

nmap -sV -p 3306 target

Usage examples

Port 3306 – MySQL

shell

mysql -h localhost -P 3306 -u root -p
ssh -L 3306:localhost:3306 user@server
mysql -h 127.0.0.1 -P 3306

Common services on this port

MySQL ServerMariaDBPercona ServerAmazon RDS MySQLAzure Database for MySQLPlanetScaleVitess

Related ports

5432

PostgreSQL

3307

MySQL alternate (multi-instance)

33060

MySQL X Protocol (document store)

History

MySQL was created by Michael Widenius at MySQL AB in 1995. Oracle acquired it via Sun Microsystems in 2010. MariaDB forked in 2009 as a community-driven alternative. Port 3306 was registered with IANA for MySQL. The X Protocol (port 33060) was added in MySQL 5.7 for document store operations.

FAQ

MySQL vs MariaDB – same port?

Yes, both default to 3306 and use the same wire protocol. MariaDB is a drop-in replacement for MySQL up to version 10.x. They diverge on features (MariaDB has Aria engine, Oracle MySQL has Group Replication) but port and protocol remain compatible.

How do I allow remote MySQL access securely?

Never open port 3306 to the internet. Options: (1) SSH tunnel – ssh -L 3306:localhost:3306 user@dbserver, then connect to localhost:3306. (2) VPN – database on private subnet, connect via WireGuard/OpenVPN. (3) Cloud IAM – RDS IAM authentication with security group restricting to your VPC.