MySQL Remote Access: Allow One IP Safely

Need an app server or your laptop to reach MySQL on another machine? Allow exactly one IP address, require TLS, and keep everyone else out.

Related guide: Full MySQL users and permissions guide

1. Listen on the network

By default MySQL on Ubuntu listens on 127.0.0.1 only. Change bind-address, then restart.

sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf
# bind-address = 0.0.0.0   (or the server's private IP)
sudo systemctl restart mysql

2. Create a user for one IP

The host part is the client's IP, so the account only works from there.

CREATE USER 'app'@'203.0.113.10' IDENTIFIED BY 'a-long-random-password' REQUIRE SSL;
GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'app'@'203.0.113.10';

3. Open the firewall to that IP only

Never open 3306 to everyone.

sudo ufw allow from 203.0.113.10 to any port 3306 proto tcp

4. Verify from the client

Run this on the client machine.

mysql -h db.example.com -u app -p --ssl-mode=REQUIRED -e 'SELECT 1;'

5. Even safer: an SSH tunnel

Keep MySQL on localhost and tunnel to it instead of opening 3306 at all.

ssh -L 3307:127.0.0.1:3306 user@db.example.com
mysql -h 127.0.0.1 -P 3307 -u appuser -p

6. Troubleshooting

Cannot connect: check bind-address, the firewall, your cloud provider's firewall, and that the user's host matches the client IP exactly.

sudo ss -tlpn | grep 3306
SELECT user, host FROM mysql.user;

FAQ

Is 'user'@'%' OK?

It allows any host. Combined with an open port 3306 it invites password attacks. Use a specific IP or a tunnel.

Does Docker bypass UFW for MySQL?

If MySQL runs in Docker with -p 3306:3306, yes: Docker's rules skip UFW. Publish it on 127.0.0.1 or filter in DOCKER-USER.

Further reading: DigitalOcean: create a new user and grant permissions in MySQL