MySQL Remote Connection Refused (Error 111): bind-address, Security Group & Firewall Diagnostics

Localhost bind-address traps, skip-networking directives, and cloud security group blockages on port 3306; emergency triage and permanent network hardening.

Reviewed by:Senior Database Architect & SRE (dataiotech Labs)

Tested Versions: MySQL 8.0 / 8.4 LTS / 9.0

Operational Verification & Reliability Metadata

Last Technical Review: 2 Kasım 2026

Tested VersionsMySQL 8.0.36, 8.4.1 LTS (Ubuntu 24.04 / Debian 12)

Required PrivilegesOS root/sudo and network access

Risk Assessment

HighSetting bind-address to 0.0.0.0 exposes port 3306 publicly without firewall rules

Expected OutputSuccessful TCP handshake to port 3306 via nc -zv or telnet

Rollback Procedure:Revert bind-address in my.cnf and systemctl restart mysql

MySQL Docs: Can't connect to MySQL server

First 60 Seconds Emergency Protocol:

The error string is a symptom, not the root cause. Do not restart the server blindly. Run the diagnostic queries below to pinpoint the actual failure mode.

▸Symptom

Remote clients attempting to connect to MySQL fail immediately with:

plaintext

ERROR 2003 (HY000): Can't connect to MySQL server on '10.0.0.5' (111)

▸What You See in Production

MySQL service is running locally on the database host, yet remote application nodes receive Connection refused (errno 111).

▸Root Cause Matrix

Probability	Root Cause	Description
%60	Localhost `bind-address` Trap	MySQL default configuration binds solely to `127.0.0.1`, dropping remote TCP handshakes.
%25	Cloud Firewall / Security Group	Port 3306 ingress blocked by cloud security groups or host firewalls (`ufw`, `iptables`).
%15	`skip-networking` Directive	TCP networking explicitly disabled in `my.cnf`.

▸EMERGENCY RUNBOOK (0-5 min)

bash

# 1. Verify listening sockets
ss -tulpn | grep 3306

# 2. Check my.cnf for bind directives
grep -rn "bind-address" /etc/mysql/

# 3. Bind to all interfaces
sudo sed -i 's/bind-address.*/bind-address = 0.0.0.0/' /etc/mysql/mysql.conf.d/mysqld.cnf
sudo systemctl restart mysql

# 4. Validate remote TCP reachability
nc -zv -w 3 10.0.0.5 3306

▸PERMANENT BLUEPRINT

1Network Layer Isolation: Restrict 3306 access strictly to private application VPC subnets.
2ProxySQL Architecture: Front the cluster with ProxySQL or MySQL Router.

▸Verification

bash

ss -tulpn | grep 3306
# Expected: 0.0.0.0:3306 or :::3306 LISTEN

Other Database Error Triage Playbooks

Other battle-tested diagnostic guides for high-severity database errors.

All Errors (82)

MYSQL4 min

MySQL ERROR 1045 Access denied: root Password Reset Guide

Four causes of MySQL 1045, meaning of using password: YES/NO, and safe credential recovery via --init-file.

MYSQL5 min

MySQL Deadlock ERROR 1213: Graph Analysis and Permanent Prevention

Root causes of MySQL 1213 deadlock, parsing LATEST DETECTED DEADLOCK output, gap lock concurrency issues, and resilient application retry design.

MYSQL5 min

MySQL Lock wait timeout exceeded: Finding Blocking Sessions

Finding the blocking transaction using performance_schema, safe KILL decision matrices, and permanent locking reduction.