The minute you implement a firewall, you failed Firewalls are made for two things: - packets alteration (iptable table mangle) - applying filtering on beh

The minute you implement a firewall, you failed Firewalls are made for two things: - packets alteration (iptable table mangle) - applying filtering on behalf of a badly configured OS So, if your case and if you want to prevent remote access to your database, you have a bad way: create a firewall rule to drop connections to tcp/3306 And you have a good way: configure your sql to bind to ::1 The firewall way requires two configuration (hence: complexity) and hide your intent : the mysql say : "I accept connections from everybody", and then the firewall say "I deny all connections". While the good way is clear and sane : one component who say : "I only accept connections from localhost"