Network ports · 3306
3306 — MySQL
Port 3306 is the default MySQL and MariaDB listener.
Key facts
| Port | 3306 |
|---|---|
| Transport | TCP |
| Service | MySQL, MariaDB |
| Default bind | Often loopback or all interfaces |
| Encryption | TLS supported, not always required |
| Exposure | Keep private |
A database port is not a public API
MySQL listens on 3306 by default. If the server is reachable from the internet and the accounts are weak, automated tools will find it and attempt credentials. The database protocol is not designed to be a public endpoint, and exposing it also exposes version information and error details.
Bind the service to a private interface or loopback, and let the application connect over the same host or a private network. Administrative access belongs through a tunnel or a bastion.
Authentication and TLS
Use per-application accounts with the smallest privileges that work, and avoid the root account for application traffic. Require TLS for remote connections so credentials and queries are not sent in clear text.
Changing the port reduces noise from generic scanners but is not a security control. Firewall rules, binding and authentication are.
Frequently asked questions
Should I change the MySQL port?
It can reduce automated noise, but it does not replace binding, firewalling and strong authentication.
How do I connect remotely without exposing 3306?
Use an SSH tunnel or a private network path, and keep the database listener bound to a private address.