You decide which services we may enable for analytics, personalization, and external content.
We use cookies and similar technologies on our website to personalize content, embed external media, and better understand how individual areas are used.
Necessary cookies
These entries support essential functions such as security, stability, and form processing.
Optional sections
Your data may be processed with your consent or on the basis of legitimate interests. In the cookie settings, you can reject or explicitly allow each optional category.
Some services process personal data in third countries. By consenting, you also agree to this transfer. You can find more information in our Privacy Policy.
You can reopen and change your selection at any time. · 1.0.2
Port 3306 is the default port for MySQL and MariaDB and uses TCP. This tool shows you the port details and generates firewall commands to restrict access to specific IP addresses.
Built by Justin Schuessler
Try the commands on your own VPS, with root access and your own firewall.
Add multiple ports one at a time, up to 12.
Databases · Registered port · OSI layer 7
Connections to MySQL and MariaDB. If the application runs on the same server, the port does not need to be open.
IANA: officially registered as mysql
Firewall commands
Open port
sudo ufw allow 3306/tcpFor Ubuntu and Debian. ufw creates the rule for both IPv4 and IPv6. If ufw is disabled, allow SSH first (sudo ufw allow 22/tcp), then enable it with sudo ufw enable, or you'll lock yourself out.
On a ZAP-Hosting VPS with an active network firewall, you also need to allow the port in the Customer Panel.
Port 3306 explained
Applications and clients connect to a MySQL or MariaDB server over port 3306. Typical users include web applications such as WordPress and Nextcloud, game server plugins for leaderboards and bans, backend services, and administration tools such as MySQL Workbench and HeidiSQL. If the application and database run on the same server, they usually connect locally via 127.0.0.1 or a Unix socket. Port 3306 needs to be reachable over the network only when the database runs on a separate server.
MySQL was released in the mid-1990s by the Swedish company MySQL AB and is now owned by Oracle. MariaDB is a fork of MySQL started by one of MySQL's original developers; it also uses port 3306. IANA has assigned port 3306 to the “mysql” service. It falls within the registered port range of 1024 to 49151.
Port 3306 should never be open to the entire Internet. Open database ports are constantly scanned by automated tools and targeted with password lists. That is why the Debian and Ubuntu packages for MySQL and MariaDB listen only on 127.0.0.1 by default, as specified by bind-address. If you need external access, allow only your app server's IP through the firewall and create database users who can log in only from that address. For occasional administration from your own computer, an SSH tunnel is safer and lets you keep port 3306 completely closed.
More ports
These ports are often part of the same setup. Click one to see its explanation and firewall commands.
View all well-known ports and the complete IANA list
Port list source: IANA Service Name and Transport Protocol Port Number Registry, as of October 22, 2026. iana.org
Discover more
Calculate the network address, broadcast address, subnet mask, and usable host range from a CIDR address, and convert between CIDR and IP ranges (IPv4 and IPv6).
Built by Jakub Martyniak
Interactively learn the 7 layers of the OSI model: click layers, assign terms such as switch, ARP, or port 443, and explore animated encapsulation, a quiz, and a cheat sheet for the IHK exam.
Built by Justin Schuessler
Interactively learn the 4 layers of the TCP/IP model (DoD model) according to RFC 1122, with OSI model mapping, animated encapsulation, a port quiz, and a cheat sheet.
Built by Justin Schuessler
Check whether specific ports are open on an IP or hostname—select a protocol or game instead of scanning all ports at once.
Built by Sebastian Rademacher
FAQ
Quick answers about port 3306.
Only if an application on another server needs direct database access. If your website or game server runs on the same system as the database, keep port 3306 closed and connect locally. An SSH tunnel is enough to administer it from your PC.
With ufw, you can allow access specifically for your app server: sudo ufw allow from 203.0.113.10 to any port 3306 proto tcp. Replace the example IP with your server's address. The bind-address in the MySQL or MariaDB configuration must also point to an address reachable from outside.
With ssh -L 3306:127.0.0.1:3306 user@dein-server, you forward local port 3306 through the SSH connection to the database server. Your database client can then connect to 127.0.0.1. Tools such as HeidiSQL and MySQL Workbench can also establish the tunnel themselves.
The server is usually listening only on 127.0.0.1 because that is the default bind-address. Other possible causes are a missing firewall rule or a database user created for localhost only. Use the port checker to see whether port 3306 is reachable from outside.
Any more questions?
Contact SupportWith a ZAP-Hosting VPS, you have root access, can set up services and firewall rules yourself, and can immediately see which ports are open.
No setup. No risk. Online in seconds.
Looking for more tools? View all network tools