> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Allow Remote MySQL Connections (bind-address)

> Allow remote connections to MySQL or MariaDB: set bind-address = 0.0.0.0, create a user for the client's IP and open port 3306 in the firewall to that IP only.

To allow remote connections to MySQL or MariaDB, set `bind-address = 0.0.0.0` in the server config (`/etc/mysql/mariadb.conf.d/50-server.cnf` for MariaDB or `/etc/mysql/mysql.conf.d/mysqld.cnf` for MySQL on Ubuntu), restart the service, create a user for the client's IP such as `'app'@'198.51.100.25'`, and allow port `3306` in your firewall from that IP only.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 10–15 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux / Rocky 9 / 10 | sudo access, the client's public IP address |

## Before you start

* Know the public IP address of the machine that will connect (your app server or your home connection). In these examples the client is `198.51.100.25` and the database server is `203.0.113.10`.
* Have a firewall running. See [UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md) or [firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md).
* [Back up your databases](https://help.freakhosting.com/portals/other/how-to-back-up-and-restore-mysql-databases.md) before changing the server.

> [!TIP]
>
> If only **you** need access (for example from HeidiSQL or MySQL Workbench), you do not need remote access at all. Use an SSH tunnel instead and keep the database closed to the internet. See [connect with HeidiSQL](https://help.freakhosting.com/portals/other/how-to-connect-to-database-using-heidisql.md).

## Why can't I connect to MySQL remotely?

On Ubuntu and Debian, MySQL and MariaDB only listen on `127.0.0.1` after installation, so only programs on the server itself can connect. Remote access needs three things to line up:

1. The server listens on a public address (`bind-address`).
2. A database account exists for the client's IP address.
3. The firewall lets that IP reach port `3306`.

## How to allow remote MySQL connections

**1. Change bind-address**

Open the config file for your server:

| Server and OS | File |
| - | - |
| MariaDB on Ubuntu / Debian | `/etc/mysql/mariadb.conf.d/50-server.cnf` |
| MySQL on Ubuntu | `/etc/mysql/mysql.conf.d/mysqld.cnf` |
| MariaDB on AlmaLinux / Rocky | `/etc/my.cnf.d/mariadb-server.cnf` |
| MySQL on AlmaLinux / Rocky | `/etc/my.cnf.d/mysql-server.cnf` |

```bash theme={null}
sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf
```

Under `[mysqld]`, change the line to:

```ini theme={null}
bind-address = 0.0.0.0
```

`0.0.0.0` listens on every IPv4 address. To listen on one address only, use the server's IP, for example `bind-address = 203.0.113.10`. If the file contains `skip-networking`, remove that line or comment it out with `#`.

**2. Restart the database server**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo systemctl restart mariadb   # MySQL: sudo systemctl restart mysql
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo systemctl restart mariadb   # MySQL: sudo systemctl restart mysqld
> ```

**3. Create a user for the client's IP**

Open the shell with `sudo mariadb` (or `sudo mysql`) and run:

```sql theme={null}
CREATE USER 'shopuser'@'198.51.100.25' IDENTIFIED BY 'Str0ng-Passw0rd!';
GRANT SELECT, INSERT, UPDATE, DELETE ON shop.* TO 'shopuser'@'198.51.100.25';
```

This account only works from `198.51.100.25`. A user that already exists for `localhost` is a separate account and keeps working.

**4. Open port 3306 to that IP only**

> [tab] Ubuntu / Debian (UFW)
>
> ```bash theme={null}
> sudo ufw allow from 198.51.100.25 to any port 3306 proto tcp
> ```

> [tab] AlmaLinux / Rocky (firewalld)
>
> ```bash theme={null}
> sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.25" port port="3306" protocol="tcp" accept'
> sudo firewall-cmd --reload
> ```

> [!WARNING]
>
> Never run `ufw allow 3306` or `firewall-cmd --add-service=mysql` without a source address on a public server. That opens the database to every IP on the internet, and automated scanners will start guessing passwords. Also avoid `'user'@'%'` accounts unless the firewall already limits who can connect.

## How to check it worked

On the server, check what MySQL listens on:

```bash theme={null}
sudo ss -ltnp | grep 3306
```

```text theme={null}
LISTEN 0  80  0.0.0.0:3306  0.0.0.0:*  users:(("mariadbd",pid=2214,fd=22))
```

If it still shows `127.0.0.1:3306`, the `bind-address` change is in the wrong file or the service was not restarted. MariaDB can print the setting it actually uses:

```bash theme={null}
mariadbd --print-defaults
```

From the client machine, connect with the MySQL client:

```bash theme={null}
mysql -h 203.0.113.10 -u shopuser -p shop
```

A `mysql>` or `MariaDB [shop]>` prompt means it works. To test only the port, see [check if a port is open from outside](https://help.freakhosting.com/portals/other/how-to-check-if-a-port-is-open-from-outside.md).

## Troubleshooting remote MySQL connections

| Error | Cause | Fix |
| - | - | - |
| `Can't connect to server on '203.0.113.10' (110)` (a timeout) | Firewall blocks port `3306` | Check the firewall rule and the client's real public IP |
| `Can't connect ...` with `(111)` or `(115)`, returned at once | Nothing listens on the public address | Fix `bind-address` and restart |
| `Host '198.51.100.25' is not allowed to connect` | No account for that IP | Create `'user'@'198.51.100.25'` |
| `Access denied for user 'shopuser'@'198.51.100.25'` | Wrong password or missing grant | Reset the password with `ALTER USER`, check `SHOW GRANTS` |

## Frequently asked questions

### Is it safe to set bind-address to 0.0.0.0?

Only together with a firewall rule that allows specific IPs. `bind-address` decides which addresses MySQL listens on; the firewall decides who can reach them.

### My home IP changes. What should I do?

Use an SSH tunnel instead of opening the port. A tool such as HeidiSQL connects over SSH and reaches MySQL on `127.0.0.1`, so nothing extra is exposed.

### Does remote MySQL traffic use encryption?

Not unless you set up TLS. Without it, queries and data cross the internet in plain text. An SSH tunnel or a private VPN such as [WireGuard](https://help.freakhosting.com/portals/other/how-to-set-up-a-wireguard-vpn-server.md) encrypts the connection.

### How do I undo remote access?

Set `bind-address = 127.0.0.1` again, restart the service, delete the firewall rule and run `DROP USER 'shopuser'@'198.51.100.25';`.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Create a database and user](https://help.freakhosting.com/portals/other/how-to-create-a-mysql-database-and-user.md)
>
> How the user and host part work.

> [card] [Connect with HeidiSQL](https://help.freakhosting.com/portals/other/how-to-connect-to-database-using-heidisql.md)
>
> Use an SSH tunnel instead.

> [card] [Set up UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md)
>
> Allow ports from chosen IPs.

> [card] [Check open ports](https://help.freakhosting.com/portals/other/how-to-check-open-ports-on-linux.md)
>
> See what your server listens on.

***

> [!NOTE]
>
> **Checked against the official [MariaDB remote connection guide](https://mariadb.com/docs/server/mariadb-quickstart-guides/mariadb-remote-connection-guide), [Ubuntu Server documentation](https://ubuntu.com/server/docs/how-to/databases/install-mysql/) and [Red Hat database server guide](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_and_using_database_servers/using-mariadb)** on 4 November 2026; config files, SQL and the UFW rule (dry run) tested on Ubuntu 24.04 LTS with MariaDB 10.11. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.