0

background purpose: I want to restrict inbound connection to MYSQL server only for specific host by setting inbound rules of windows firewall. I mean, I want to allow only specific host to connect to the MYSQL server.

In the windows firewall setting, this is what I saw by default:

enter image description here

both ports are opened. so, I blocked all the inbound connection to the port 33060 because I don't expect inbound from X-Protocol:

enter image description here

Then, I tried to connect to the MYSQL server from my local pc and the connection succeeded. Next, I tried to restrict inbound connection to the port 3306 of the MYSQL server only to specified IP address:

at first, select Allow the connection if it is secure. enter image description here

second, specified remote IP address by which I am connecting to this MYSQL server. enter image description here

in the part of black out in the image above, I typed my global IP address(IPv4) of my local pc. I typed it in XX.XXX.XXX.XX format. I got my global IP address in this onlne service. then I tested to connect to the MYSQL server from my local pc, but it didn't get through.

I tested connection by Test-NetConnection in windows powershell. But, the connection to the port failed..

enter image description here

what am I wrong with?

Test1:

I tested like the below, too.

I change setting like below: Remote IP address to by Any IP address.

enter image description here

and left the setting below as it is:

Allow the connection if it is secure

enter image description here

then, try Test-NetConnection in windows powershell. but it doesn't get through to the port..

Test2:

I again tested like the below, too.

I keep setting like below: Remote IP address.

enter image description here

and changed the setting below:

Allow the connection

enter image description here

then, try Test-NetConnection in windows powershell. but it doesn't get through to the port again..

Herbert
  • 103
  • 1
  • 5

2 Answers2

0

Remove the option "allow the connection if it is secure". This adds an additional authentication and encryption layer that isn't supported by the MySQL client. You can't use it here.

Additionally, if you only get the message failed, as in your screenshot, then the MySQL server is not listening on that interface. If the problem were the firewall, you would get a message TimedOut.

Make sure the MySQL server is listening on the external interface or all interfaces (0.0.0.0) instead of only the loopback interface (127.0.0.1), which is most probably the default.

You can check this by running this on the server:

Get-NetTCPConnection -State Listen -LocalPort 3306
Gerald Schneider
  • 23,274
  • 8
  • 57
  • 89
0

You need to change the setting to Allow this connection, not "Allow this connection if it is secure".

The latter setting will allow the connection only if it is protected via IPSec, which you almost certainly are not using and will never use.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972