How to fix CR_CONN_HOST_ERROR (2003): Can't connect to MySQL server on host:port in MySQL

# Check MySQL service status
sudo systemctl status mysql
# or
sudo systemctl status mysqld

# Check if MySQL process is running
ps aux | grep mysqld
sudo pgrep -a mysql

# Check which port MySQL is listening on
sudo netstat -tlnp | grep mysql
sudo ss -tlnp | grep mysql
# Should show: tcp 0 0 0.0.0.0:3306 or 127.0.0.1:3306

# Start MySQL if not running
sudo systemctl start mysql
# or
sudo service mysql start

# Check MySQL error logs for startup issues
sudo tail -50 /var/log/mysql/error.log
sudo journalctl -u mysql -n 50

# Test connection to MySQL port using telnet
telnet mysql-server.example.com 3306
# or
telnet 192.168.1.100 3306

# Alternative: use nc (netcat)
nc -zv mysql-server.example.com 3306

# Test from the client machine
# If connection succeeds, you'll see MySQL version banner
# If it fails with "Connection refused", MySQL isn't listening
# If it hangs/times out, firewall or network issue

# Check DNS resolution
ping mysql-server.example.com
dig mysql-server.example.com
nslookup mysql-server.example.com

# Test with IP address to rule out DNS issues
mysql -h 192.168.1.100 -u root -p

# Check current bind-address setting
mysql -e "SHOW VARIABLES LIKE 'bind_address';"

# Output meanings:
# 127.0.0.1 or localhost = local connections only (causes error 2003 remotely)
# 0.0.0.0 or * = listen on all interfaces (allows remote connections)
# Specific IP = listen only on that interface

# Edit MySQL configuration file
sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf
# or
sudo nano /etc/my.cnf

# Find and modify bind-address:
[mysqld]
# For remote connections from any interface:
bind-address = 0.0.0.0

# Or for specific network interface:
bind-address = 192.168.1.100

# Make sure skip-networking is NOT enabled:
# skip-networking  # Remove or comment out this line

# Restart MySQL to apply changes
sudo systemctl restart mysql

# Verify MySQL is now listening on all interfaces
sudo netstat -tlnp | grep :3306
# Should show: 0.0.0.0:3306 instead of 127.0.0.1:3306

# Ubuntu/Debian with UFW
sudo ufw allow 3306/tcp
sudo ufw allow from 192.168.1.0/24 to any port 3306  # Specific subnet
sudo ufw status

# CentOS/RHEL with firewalld
sudo firewall-cmd --permanent --add-service=mysql
# or specific port:
sudo firewall-cmd --permanent --add-port=3306/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

# Direct iptables (if not using ufw/firewalld)
sudo iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
sudo iptables -L -n | grep 3306
sudo iptables-save > /etc/iptables/rules.v4  # Save rules

# AWS Security Group (using AWS CLI)
aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp \
  --port 3306 \
  --cidr 0.0.0.0/0  # Or restrict to specific IPs

# Google Cloud Firewall
gcloud compute firewall-rules create allow-mysql \
  --allow tcp:3306 \
  --source-ranges 0.0.0.0/0

# Test after firewall changes
nc -zv your-server-ip 3306

-- Connect to MySQL on the server
mysql -u root -p

-- Check which hosts the user can connect from
SELECT user, host FROM mysql.user WHERE user = 'your_username';

-- Common host values:
-- 'localhost' = local connections only (won't work remotely)
-- '%' = any host (allows all remote connections)
-- '192.168.1.%' = specific subnet
-- 'client.example.com' = specific hostname

-- Grant remote access to existing user
GRANT ALL PRIVILEGES ON database_name.* 
  TO 'username'@'%' 
  IDENTIFIED BY 'password';

-- Or create new user with remote access
CREATE USER 'username'@'%' IDENTIFIED BY 'strong_password';
GRANT ALL PRIVILEGES ON database_name.* TO 'username'@'%';

-- For specific IP or subnet
CREATE USER 'username'@'192.168.1.%' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON database_name.* TO 'username'@'192.168.1.%';

-- Apply changes
FLUSH PRIVILEGES;

-- Test connection from client
mysql -h mysql-server-ip -u username -p

# Check what port MySQL is actually listening on
mysql -e "SHOW VARIABLES LIKE 'port';"
sudo netstat -tlnp | grep mysql

# Common MySQL ports:
# 3306 = default MySQL
# 3307, 3308 = alternate ports (multiple instances)
# 33060 = MySQL X Protocol

// PHP PDO - correct format
$dsn = "mysql:host=192.168.1.100;port=3306;dbname=mydb";
$pdo = new PDO($dsn, $username, $password);

// PHP mysqli
$mysqli = new mysqli("192.168.1.100", $user, $pass, $db, 3306);

# Python mysql-connector
import mysql.connector

config = {
    'host': '192.168.1.100',
    'port': 3306,  # Explicit port
    'user': 'username',
    'password': 'password',
    'database': 'mydb',
    'connect_timeout': 10  # Avoid long hangs
}

connection = mysql.connector.connect(**config)

// Node.js mysql2
const mysql = require('mysql2/promise');

const connection = await mysql.createConnection({
  host: '192.168.1.100',
  port: 3306,
  user: 'root',
  password: 'password',
  database: 'mydb',
  connectTimeout: 10000
});

# Environment variables in .env files
DB_HOST=192.168.1.100
DB_PORT=3306
DB_USER=username
DB_PASSWORD=password
DB_NAME=database

# Check SELinux status (CentOS/RHEL)
getenforce
# If "Enforcing", check for MySQL denials

sudo ausearch -m avc -ts recent | grep mysql
sudo grep mysql /var/log/audit/audit.log

# Allow MySQL to connect to network
sudo setsebool -P mysql_connect_any 1

# Or temporarily disable to test (not for production)
sudo setenforce 0
# Re-enable after testing:
sudo setenforce 1

# Check AppArmor (Ubuntu/Debian)
sudo aa-status | grep mysql

# View AppArmor denials
sudo dmesg | grep DENIED | grep mysql
sudo journalctl | grep apparmor | grep mysql

# Edit AppArmor profile if needed
sudo nano /etc/apparmor.d/usr.sbin.mysqld

# Reload AppArmor profile
sudo systemctl reload apparmor

# Temporarily disable AppArmor for MySQL (testing only)
sudo aa-complain /usr/sbin/mysqld