0

background purpose: I want to restrict inbound connection to MYSQL server only for specific host by setting inbound rules of windows firewall. I mean, I want to allow only specific host to connect to the MYSQL server.

In the windows firewall setting, this is what I saw by default:

enter image description here

both ports are opened. so, I blocked all the inbound connection to the port 33060 because I don't expect inbound from X-Protocol:

enter image description here

Then, I tried to connect to the MYSQL server from my local pc and the connection succeeded. Next, I tried to restrict inbound connection to the port 3306 of the MYSQL server only to specified IP address:

at first, select Allow the connection if it is secure. enter image description here

second, specified remote IP address by which I am connecting to this MYSQL server. enter image description here

in the part of black out in the image above, I typed my global IP address(IPv4) of my local pc. I typed it in XX.XXX.XXX.XX format. I got my global IP address in this onlne service. then I tested to connect to the MYSQL server from my local pc, but it didn't get through.

I tested connection by Test-NetConnection in windows powershell. But, the connection to the port failed..

enter image description here

what am I wrong with?

Test1:

I tested like the below, too.

I change setting like below: Remote IP address to by Any IP address.

enter image description here

and left the setting below as it is:

Allow the connection if it is secure

enter image description here

then, try Test-NetConnection in windows powershell. but it doesn't get through to the port..

Test2:

I again tested like the below, too.

I keep setting like below: Remote IP address.

enter image description here

and changed the setting below:

Allow the connection

enter image description here

then, try Test-NetConnection in windows powershell. but it doesn't get through to the port again..

4
  • Use the GRANT command in MySQL.
    – Rick James
    Aug 24, 2020 at 18:23
  • @RickJames Thanks for your advice but I would like to restrict inbound connection by firewall setting.
    – Herbert
    Aug 25, 2020 at 4:47
  • So, this is a "firewall" question, not a database question? Update the tags.
    – Rick James
    Aug 25, 2020 at 5:20
  • @RickJames sorry. updated.
    – Herbert
    Aug 25, 2020 at 5:37

2 Answers 2

0

You need to change the setting to Allow this connection, not "Allow this connection if it is secure".

The latter setting will allow the connection only if it is protected via IPSec, which you almost certainly are not using and will never use.

3
  • I tested it after removing the option but it doesn't get through. I update OP about that, too.
    – Herbert
    Aug 25, 2020 at 6:06
  • @Herbert Now you need to check that you used the correct IP address. Aug 25, 2020 at 6:07
  • the global IP address of my client local pc is the one I got on this page. So, i think it should be correct?
    – Herbert
    Aug 25, 2020 at 6:18
0

Remove the option "allow the connection if it is secure". This adds an additional authentication and encryption layer that isn't supported by the MySQL client. You can't use it here.

Additionally, if you only get the message failed, as in your screenshot, then the MySQL server is not listening on that interface. If the problem were the firewall, you would get a message TimedOut.

Make sure the MySQL server is listening on the external interface or all interfaces (0.0.0.0) instead of only the loopback interface (127.0.0.1), which is most probably the default.

You can check this by running this on the server:

Get-NetTCPConnection -State Listen -LocalPort 3306
2
  • I tested it after removing the option but it doesn't get through. I update OP about that, too.
    – Herbert
    Aug 25, 2020 at 6:06
  • How does it "not get through"? Do you get a timeout or a connection refused? Aug 25, 2020 at 6:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .