PORTTLS optionalKeep privateIANA assigned
Port 3306MySQL / MariaDB
Port 3306 is the default TCP port for MySQL and MariaDB database servers. Applications, ORMs and tools such as MySQL Workbench connect to it. It should listen only on localhost or a private network; a MySQL server reachable from the internet on 3306 is a common breach source.
What port 3306 is used for
Port 3306 is where the MySQL classic protocol lives. WordPress, Drupal, Laravel, Django and countless internal applications talk to their database here, as do administration tools (Workbench, phpMyAdmin's back end, DBeaver, HeidiSQL) and replication between servers.
MySQL 8 also offers the X Protocol on 33060 for document-store features; MariaDB does not use it.
Where it should listen
| Deployment | Recommended binding |
|---|---|
| Application and database on one host | 127.0.0.1 or a Unix socket; no network exposure |
| Separate application servers | Private network interface only, firewalled to those servers |
| Managed cloud database | Provider's private endpoint; public access disabled |
The bind-address setting controls this. 0.0.0.0 listens everywhere and is the value most often found on breached servers.
Security considerations
- Exposed 3306 plus weak root password is a breach. Internet-wide scans find and brute-force MySQL constantly.
- Do not grant
'user'@'%'unless the host pattern is deliberately broad; scope grants to application server addresses. - Enable TLS for connections across any network you do not fully control, and require it for replication.
- Separate accounts per application, with only the privileges each needs.
How to check port 3306
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :3306A line in the LISTENING state means a local program has bound port 3306; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :3306 or lsof -i :3306.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection db.internal.example -Port 3306TcpTestSucceeded : True means the remote system accepted a TCP connection on port 3306. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Check what MySQL is bound to from inside the server:
SHOW VARIABLES LIKE 'bind_address';
SHOW VARIABLES LIKE 'port';Firewall considerations
Allow inbound TCP 3306 only from application-server addresses. On a developer PC running a local stack, no inbound rule is needed. Cloud security groups should never allow 3306 from 0.0.0.0/0.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 3306 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Should port 3306 be open?
Only to the application servers that need it, and ideally not at all if the application runs on the same host (use localhost or a Unix socket). Never to the internet.
Can't connect to MySQL server on host (10061). What does it mean?
Error 10061 is a TCP connection refused: nothing is listening at that address and port. Check that the service is running, that bind-address includes the interface you are connecting to, and that a firewall is not dropping the connection.
Is MySQL traffic encrypted?
Modern MySQL and MariaDB can require TLS per user (REQUIRE SSL) and ship with auto-generated certificates, but clients may fall back to plain text unless --ssl-mode=REQUIRED or the equivalent is set.