Port 3306 — MySQL / MariaDB

Q: How do I check if port 3306 is open?

Locally, sudo lsof -i :3306 on macOS or Linux, or netstat -ano | findstr :3306 on Windows. From outside, nc -zv host 3306 tells you whether anything answers.

TCP registered

What runs on port 3306

The default MySQL and MariaDB port.

MySQL and MariaDB. The most important thing about this port is that it should not be reachable from the internet, and the second is that localhost and 127.0.0.1 are not the same thing to a MySQL client — the first uses a Unix socket and the second uses TCP on this port, and they can have different permissions and even connect to different servers. "Access denied for localhost" that works with 127.0.0.1 is that distinction.

Security considerations

Bind to 127.0.0.1 unless a remote application genuinely needs it, and then restrict by source address. Internet-exposed MySQL is scanned constantly.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :3306
sudo ss -lntp | grep :3306

# Windows
netstat -ano | findstr :3306
Get-NetTCPConnection -LocalPort 3306

# is it reachable from outside?
nc -zv example.com 3306
curl -v telnet://example.com:3306

Freeing the port

# find the process, then stop it
sudo lsof -ti :3306 | xargs kill        # Linux / macOS
netstat -ano | findstr :3306            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

No. Port 3306 should never be reachable from a public address. Bind it to localhost or a private network, and reach it through a VPN or bastion host if remote access is genuinely needed. Internet-wide scanners find newly exposed instances of this service within minutes.

Opening or blocking port 3306

There is no blanket-allow rule on this page, because there is no case for one. MySQL / MariaDB on port 3306 should be reachable from named addresses or not at all, so what follows restricts rather than opens:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 3306 proto tcp
sudo ufw deny 3306/tcp                    # everything else

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=3306 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3306 -j DROP

# Windows
New-NetFirewallRule -DisplayName "MySQL / MariaDB 3306" -Direction Inbound -Protocol TCP -LocalPort 3306 -RemoteAddress 10.0.0.0/8 -Action Allow

Change 10.0.0.0/8 to whatever your private range actually is. A firewall rule is the second line: the first is binding the service to a private interface, because a service that only listens on 127.0.0.1 cannot be reached however the firewall is configured.

Quick reference

Port	3306
Protocol	TCP
Service	MySQL / MariaDB
Range	Registered (1024–49151) — any user process may bind

Frequently asked questions

What is port 3306 used for?

The default MySQL and MariaDB port.

Is it safe to open port 3306?

Bind to 127.0.0.1 unless a remote application genuinely needs it, and then restrict by source address. Internet-exposed MySQL is scanned constantly.

How do I check if port 3306 is open?

Locally, sudo lsof -i :3306 on macOS or Linux, or netstat -ano | findstr :3306 on Windows. From outside, nc -zv host 3306 tells you whether anything answers.

Why do I get "address already in use" on port 3306?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :3306 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers