Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently set up an ubuntu server to host my site - I need to open up port 3306 for MySQL access on my server.

I'm currently using shorewall on my server - how can open incoming connections to 3306 in shorewall? - Here are my current rules (enabling incoming for 80/HTTP and 22/SSH).

ACCEPT        $FW        net        icmp
HTTP/ACCEPT   net        $FW
SSH/ACCEPT    net        $FW

What is the rule name for the MySQL port (3306). Also, is it possible to enable ports just by port not by a name?

share|improve this question
up vote 1 down vote accepted

You do not want to enable MySQL access from the Internet at large. There is no reason to do so. If you need access for development purposes, just use an ssh tunnel. For local applications, they will be able to access MySQL via socket or loopback without any firewall changes.

share|improve this answer
My server is also protected by an external firewall, this is just so I can manage it locally from a gui. – Alex Coplan Jan 3 '12 at 14:00
Actually, just realised my client supports connection via SSH, so this is definitely the way to go (as it would allow secure external connections as well) - could you explain in more detail about socket/loopback for local apps - I haven't attempted to connect to my db through php yet, should it work just fine by defualt if I just use localhost ?? – Alex Coplan Jan 3 '12 at 14:06
If you have skip-networking enabled in mysql, then you'll need to connect via the UNIX socket, which I believe php will do by default if you specify "localhost" as the database host. – EEAA Jan 3 '12 at 15:21

5th column is the destination port:

ACCEPT      net                     $FW     tcp     3306

As pointed out it's not a good idea to open your MySQL server to the entire world. At the very least you should limit access to a certain IP(-range):

ACCEPT      net:      $FW     tcp     3306
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.