Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This may be more of a server question, but it's development related, and since I'm a developer I hope it's appropriate here.

I want to connect to a MySQL DB that is hosted with an ISP using something like TOAD, Navicat or HeidiSQL. I was told by the ISP that MySQL is listening on port 3306 but the hardware firewall is not allowing outside connections to access (only localhost). I have the option of giving them IPs to add to the firewall, but that's not ideal b/c I work from home or on the road mostly so my IP is always changing. If I open this up am I asking for trouble? Are there any measures besides adding my IP to an IP table that I could do to mitigate the risks?

share|improve this question

migrated from Jun 22 '11 at 20:06

This question came from our site for professional and enthusiast programmers.

It is always a bad idea to allow direct connections to your database. – zerkms Jun 21 '11 at 0:03
up vote 5 down vote accepted

Generally restricting MySQL access to an ip address is a good idea. There can be some security concerns but a good firewall should mitigate some of them. They would have to create an additional MySQL user for you since MySQL does not allow multiple hosts (unless there's a wildcard) per user. You could request multiple users, one for each host that you are connecting from or even do partial hosts (eg.

An alternative solution is to create a ssh tunnel from your machine so that you can connect locally.

Here's a good article on how you can create a ssh tunnel with MySQL.

share|improve this answer
+1 Yep, MySQL supports SSL itself, but it's confusing to use. It's easier to use an ssh tunnel with port-forwarding. – Bill Karwin Jun 21 '11 at 0:10

DO NOT open 3306.

Instead, do what every other server does: Open port 22 for secure ssh connection, then once logged on, connect locally to mysql.

share|improve this answer
Thanks. I've been able to SSH to the box su to root the # mysql -u root to get to the mysql cli. I assume that means I've got everythign in place to tunnel, right? Have never set it up that way, but I guess I'll learn :-) Thanks – Don Jun 21 '11 at 0:07

While you can keep your authentication secure by being very careful with grants and requiring SSL. You have no protection against potential undiscovered exploits that may be used.

Some SQL clients have an SSH tunnel option which is a better idea.

share|improve this answer

Since you mentioned Navicat, check out its HTTP tunnel feature. If you name/locate that tunnel endpoint obscurely and use HTTP authentication on the file itself (in addition to your MySQL authentication), you eliminate all but the most targeted attacks.

share|improve this answer
Thanks. I ended up using the SSH tunnel and it works well. No need to worry about IP tables or anything. Appreciate the help. – Don Jun 23 '11 at 3:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.