Recommended Free Tools
To make MySQL local-only on an Ubuntu VPS, set bind-address = 127.0.0.1 in /etc/mysql/mysql.conf.d/mysqld.cnf under [mysqld], restart MySQL, and verify that it listens only on loopback. Then deny inbound TCP port 3306 in UFW and in your VPS provider’s firewall or security group. This combination removes both the database listener’s network exposure and any remaining firewall path.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The change does not remove local Unix-socket access, so applications running on the same VPS can usually continue using MySQL. Applications on another host will need a private-interface binding, a restricted firewall rule, or an SSH/VPN path instead.
As an Amazon Associate I earn from qualifying purchases.
What “disable remote access” actually changes
MySQL can accept connections through a local Unix socket, through TCP on a network interface, or through both. Remote access is possible when the MySQL process listens on an address reachable from another machine and the network path allows TCP port 3306.
Setting the listener to loopback makes MySQL accept TCP connections only from the VPS itself. It does not stop a local web server, game panel, script, or command-line client from connecting through the local socket. A firewall rule is still important because it closes the network path even if a later configuration change accidentally broadens the listener.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
| Configuration | Where MySQL listens | Typical result |
|---|---|---|
bind-address = 127.0.0.1 |
IPv4 loopback only | Local TCP and local socket connections work; remote TCP connections are rejected at the listener. |
| A private IPv4 or IPv6 address | One selected interface | Hosts that can reach that private interface may connect, subject to authentication and firewall rules. |
0.0.0.0 or an equivalent wildcard |
All IPv4 interfaces | Every reachable interface can expose port 3306 unless a firewall blocks it. |
[::] or another IPv6 wildcard |
All or many IPv6 interfaces | IPv6 can remain remotely reachable even when you checked only IPv4 rules. |
skip_networking |
No TCP/IP listener | TCP connections are disabled entirely; local Unix-socket access can remain. |
Authentication errors and blocked network connections are different failures. A remote client that reaches MySQL but supplies invalid credentials can receive an authentication error. A client that cannot reach a listener or firewall path will normally fail or time out before MySQL authenticates it.
Check the current exposure before editing
Log in to the VPS and inspect every MySQL-related listener:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo ss -lntp | grep -E 'mysql|3306'Read the address in the result, not just the port number:
0.0.0.0:3306means MySQL is listening on every IPv4 interface.[::]:3306means an IPv6 wildcard listener is present.127.0.0.1:3306means IPv4 TCP is limited to the VPS itself.- An entry with no 3306 TCP listener may indicate that networking is disabled or that MySQL is stopped; local socket access can still be available in the latter cases.
Record the current output before making changes. Also identify whether the application and database are on the same VPS. If the application runs elsewhere, changing to loopback will intentionally break its TCP connection and you should use the private-network procedure later in this guide.
Disable remote TCP access on an Ubuntu package installation
1. Edit the MySQL server option file
For the standard Ubuntu package layout, open the server configuration file:
sudo nano /etc/mysql/mysql.conf.d/mysqld.cnfFind the [mysqld] section and add or change this setting:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
[mysqld]
bind-address = 127.0.0.1Keep the setting in the server section, not in a client section. The address must belong to the VPS; 127.0.0.1 is the IPv4 loopback address and is present on a normal installation. MySQL reads bind_address when it starts, so editing the file alone does not change the active listener.
If your installation uses a different option-file layout, first confirm which file the service loads rather than creating an unrelated file. The path above is the Ubuntu package path described for this procedure.
2. Restart MySQL
Apply the startup setting by restarting the service:
sudo systemctl restart mysql.serviceA successful command usually returns no text. Do not assume the change worked until you inspect the listener again.
3. Verify the listener and service logs
Run:
sudo ss -lntp | grep mysqlThe expected TCP result is a listener on 127.0.0.1:3306, with no wildcard or public-interface entry. If the restart fails, inspect the service journal:
sudo journalctl -u mysqlLook for configuration syntax errors, a duplicate or conflicting setting, a port already in use, or an address that is not configured on the VPS. Correct the reported problem, restart again, and repeat the listener check. A failed restart can leave the application without a database, so check the service state before troubleshooting the firewall.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
4. Deny inbound TCP 3306 with UFW
MySQL should not rely on its bind setting as the only control. If UFW is enabled, inspect its numbered rules:
sudo ufw status numberedRemove any broad rule that permits 3306, then deny the port:
sudo ufw deny 3306/tcpThe deny rule protects against an accidental future change to the MySQL bind address. If you administer rules remotely, confirm that your SSH rule remains allowed before changing UFW, and use the numbered status output to remove only the intended MySQL rule.
UFW is only the host-level firewall. Open the VPS provider’s external firewall, security group, or network ACL and make sure inbound TCP 3306 is also denied there. A provider rule can expose the port even when you are reviewing UFW, and a host rule cannot override a provider policy that permits or routes traffic in an unexpected way.
5. Test local and remote behavior separately
On the VPS, test the application’s normal local connection. A Unix-socket connection can continue to work after remote TCP is disabled, so a successful local login does not prove that port 3306 is exposed.
From a different host, perform a TCP connection test to the VPS’s address and port 3306. The expected result is a refusal or timeout, depending on which layer blocks it. If the remote client instead receives a MySQL authentication error, the request reached a MySQL listener; return to the ss output and firewall rules rather than changing credentials first.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
When to use skip_networking
skip_networking disables MySQL’s TCP/IP networking entirely. Local programs can still use the Unix socket, but no TCP client—local or remote—can connect. This is stricter than binding to 127.0.0.1, because even a local process that explicitly connects to 127.0.0.1:3306 will no longer have a TCP path.
Use it only when every consumer is on the same machine and is configured for socket access. Add the option under [mysqld] in the same server option file, restart MySQL, and verify that no 3306 TCP listener appears:
[mysqld]
skip_networkingBefore choosing this mode, check connection settings in the web application, maintenance scripts, monitoring agents, and scheduled jobs. A program configured with a TCP host and port may fail even though a command-line client using the default local socket succeeds.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If another host genuinely needs database access
Do not bind to a public wildcard merely to make a multi-host application work. Bind MySQL to the specific private IPv4 or IPv6 address used by the application network, then restrict the firewall to the application host or private subnet.
| Access design | Network exposure | Source restriction | Transport | Operational trade-off |
|---|---|---|---|---|
| Single-VPS application | Loopback only | Not applicable to remote hosts | Unix socket or local TCP | Lowest exposure and simplest operation. |
| Private application network | One private interface | Application IP or private subnet only | Private TCP; add TLS when required by your deployment | Supports separate hosts without exposing the public interface; requires stable private addressing and matching firewall rules. |
| Administrative or occasional access | Keep MySQL off the public interface | SSH tunnel or VPN path | Encrypted tunnel | More setup, but no public 3306 listener is needed. |
| Public-interface binding | Public address or wildcard | Must be tightly source-restricted | TCP with appropriate encryption and authentication | Highest exposure and the greatest firewall and monitoring burden; avoid it when a private path is available. |
MySQL’s secure-deployment guidance supports binding to a specific IPv4 or IPv6 address so the server accepts TCP only on that address. In UFW, a source-specific rule can be used instead of a broad allow; for example, after replacing APP_IP with the application host’s real address, an administrator might allow only that source to reach 3306:
sudo ufw allow from APP_IP to any port 3306 proto tcpKeep the MySQL bind address and firewall source rule aligned. A private bind without a matching route or firewall allow is unreachable; a permissive firewall without a narrow bind leaves more interfaces exposed than necessary. An SSH tunnel or VPN is often preferable for administration because the database remains off the public interface; the exact tunnel command depends on your provider, account names, and network topology.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Troubleshooting common failures
The service will not restart
Run sudo journalctl -u mysql and read the first configuration or address error, not just the final systemd summary. Confirm that bind-address is spelled correctly, is under [mysqld], and names an address configured on the VPS. Fix the file, restart, and verify with ss.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchss still shows 0.0.0.0:3306 or [::]:3306
MySQL is still listening beyond loopback. Confirm that you edited the option file loaded by this service, that the setting is in the server section, and that the restart completed successfully. Check both IPv4 and IPv6 output; closing an IPv4 path does not by itself remove an IPv6 wildcard listener. Then inspect UFW and the provider firewall for an independent exposure.
The local application stopped working
Determine how it connects. A socket-based configuration should continue to work with loopback binding. A configuration that names a remote hostname, a private address, or 127.0.0.1:3306 may need to be changed to the intended local socket or private-interface design. Do not weaken MySQL to a wildcard listener just to conceal a connection-setting mistake.
A remote test times out, but you expected an authentication prompt
A timeout generally indicates that the listener, host firewall, provider firewall, routing, or security group is blocking the path. Check the listener with sudo ss -lntp | grep -E 'mysql|3306', then check sudo ufw status numbered and the provider’s network rules. If the test reaches MySQL and returns an authentication error, network blocking is not the immediate problem.
You need to restore remote access temporarily
Use the narrowest design that meets the requirement: bind to the application’s private address and permit only its source address or subnet. Avoid reverting to 0.0.0.0 as a troubleshooting shortcut. After any change, restart MySQL, inspect both IPv4 and IPv6 listeners, and test from the actual application host.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Final verification checklist
- The effective MySQL setting under
[mysqld]isbind-address = 127.0.0.1, unless you deliberately selected a private address. sudo systemctl restart mysql.servicecompleted successfully.sudo ss -lntp | grep mysqlshows loopback only and no public or wildcard listener.- UFW has no broad allow for 3306 and includes
sudo ufw deny 3306/tcpwhen the database is local-only. - The VPS provider’s firewall or security group denies inbound TCP 3306.
- A local socket connection used by the application still succeeds.
- A TCP test from another host fails or times out when remote access is supposed to be disabled.
- If remote access remains necessary, the bind address, source-restricted firewall rule, routing, and transport protection all match the application topology.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
