Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup a mysql server on my machine. I would like to limit the domains that it listens for connections to. My understanding is that you can either have it listen to 1 ip or all ip's. Therefore, if i want to connect remotely I have to say all ips. Then I would like to block all domains but the ones I know should actually be connecting.. I believe this is done through windows firewall. However, how do i do this by domain instead of IP?

share|improve this question
you can limit the host of each user of mysql. This means you can define from where you can login with this user, isn't that something of what you are looking for? – Sven Jung Nov 22 '12 at 20:48
yes, this i can do. regardless of whether mysql has that limit or not, i want my system to reject connections from all hosts that are invalid – Alex Nov 22 '12 at 21:38
do you want to ban particular ip's only for mysql or for your entire server? – Sven Jung Nov 23 '12 at 8:00
for my entire server. and in particular, i want to allow only certain domains. – Alex Nov 23 '12 at 18:01

In mysql users are stored in the form user@host with % as a wildcard, and all non-matching hosts are blocked by default. Usually at install only the root@localhost account is created, and usually without a password.

You can define users in such forms as:

--allow login anywhere
CREATE USER 'user'@'%' IDENTIFIED BY 'password';

--allow from hosts in the domain
CREATE USER 'user'@'' IDENTIFIED BY 'password';

--allow from hosts in the subnet
CREATE USER 'user'@'123.123.123.%' IDENTIFIED BY 'password';

Bear in mind that if you use the same username for two different networks, ie:

CREATE USER 'user'@'123.123.123.%' IDENTIFIED BY 'password1';
CREATE USER 'user'@'213.213.213.%' IDENTIFIED BY 'password2';

their passwords are managed completely separately.

If you require more granular control than this then you will want to use a firewall.

You can view existing users by running:

USE mysql;
SELECT * FROM users;

Relevant Documentation

share|improve this answer
thank you for your response. i have done this already but i would like to make sure that my computer itself is filtering connections as well just to be doubly safe. how do i set this up in windows firewall? – Alex Nov 22 '12 at 22:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.