Remote MariaDB access without leaving port 3306 open to everyone

For connections inside a private server network, bind MariaDB to the database server's private address. Prefer a VPN or SSH tunnel for access across the public internet:

nano /etc/mysql/mariadb.conf.d/50-server.cnf

Replace 10.0.0.10 with the database server's private address. There is no need to listen on every interface:

bind-address = 10.0.0.10

Save (Ctrl+X, Y, Enter). Restart MariaDB:

sudo systemctl restart mariadb

• Firewall: Allow only the client: <code>sudo ufw allow from CLIENT-IP to any port 3306 proto tcp</code>.
• Security: Use strong credentials, minimum privileges and encrypted connections. Verify the listening address with <code>ss -lntp</code>.