Service Listening Address

1 Problem Description

After setting up the MySQL service on ECS, everything was normal with the firewall security group, yet remote access was not possible.

2 Troubleshooting

2.1 Check Connectivity

Use a local computer to scan the server ports, and the results are as follows:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

 ⚡yangz ❯❯ nmap -sS MD
Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-26 19:23 China Standard Time
Nmap scan report for MD 
Host is up (0.045s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   open   http
443/tcp  closed https
3306/tcp closed   mysql

The results indicate that port 3306 is allowed, but the server is not functioning properly.

2.2 Check Ports

Check the usage of all ports on ECS:

1
2
3
4

root@minedl:~# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      24735/mysqld 

MySQL is bound to the local loopback address, so it cannot provide external services. This is where the problem lies.

3 Binding Address Configuration

MySQL’s default configuration is to listen to the service address on 127.0.0.1, which does not provide external services. Change the binding address to 0.0.0.0 to support remote access, configure as follows:

1

vim /etc/mysql/mysql.conf.d/mysqld.cnf

Modify the bind-address to 0.0.0.0, note that you cannot simply comment it out, otherwise it will result in the second outcome below.

1
2
3

tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      24735/mysqld # Only listens to localhost
tcp6       0      0 :::3306                 :::*                    LISTEN      24794/mysqld # Only listens to IPv6, not IPv4
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      24877/mysqld # Listens to all IPv4

The third result appears, and local access is also successful.

4 Summary

Many software and frameworks default to binding the address to 127.0.0.1, which cannot be accessed from other machines. It needs to be changed to 0.0.0.0 or :::, the former provides IPv4 services, and the latter provides IPv6 services.