MySQL throws Error 1130 when a client machine or IP is not listed in the server's privilege tables, blocking the network connection.
MySQL Error 1130: ER_HOST_NOT_PRIVILEGED occurs when the server rejects a client because its host or IP lacks connection privileges. Grant the host explicit rights with GRANT ALL PRIVILEGES ON *.* TO 'user'@'host' IDENTIFIED BY 'pwd' or adjust firewall and bind-address settings to resolve the issue.
Host '%s' is not allowed to connect to this MySQL server
MySQL raises Error 1130 with the message "Host '%s' is not allowed to connect to this MySQL server" when the server denies a network request from a client host. The privilege tables in the mysql database do not contain a matching user@host entry, so authentication never starts.
This error surfaces during initial TCP handshake, often surprising administrators because credentials look correct.
Fixing it is crucial because no SQL code runs until connectivity is restored.
The error appears immediately after a client issues the CONNECT packet. It is common after new server installs, IP changes, cloud migrations, or tighter firewall rules. Remote GUI tools, CLI clients, application pools, and CI pipelines can all trigger the message.
Production services halt if they cannot reach MySQL.
Solving Error 1130 quickly restores application uptime, prevents data-access failures, and avoids cascading outages.
Lack of a proper GRANT entry for the connecting host is the primary cause. MySQL scans the user table by host pattern; if no row matches, it refuses the connection.
Misconfigured bind-address, skip-networking, or firewall filtering can also block the host, producing the same error even if privileges exist.
First confirm the client IP shown in the error.
Then log in locally as root or another privileged account and create or update a GRANT rule that whitelists that IP or subnet. Flush privileges so changes take effect immediately.
If a GRANT rule already exists, inspect bind-address, skip-networking, and firewalls. Ensure mysqld listens on 0.0.0.0 (or specific public IP) and that port 3306 is open.
New Cloud VM: Cloud providers often assign dynamic public IPs.
Use a '%'wildcard or correct the IP in GRANT statements.
Docker Containers: Containers use internal networks. Expose port 3306 and grant to '172.%' or use host networking.
Office VPN: VPN subnets differ from on-prem ones. Add an extra GRANT for the VPN range.
Maintain a documented list of approved hosts and automate GRANT scripts in deployment pipelines. Monitor connection errors in MySQL error logs and alert on spikes.
Use host wildcards sparingly and prefer least privilege.
Galaxy users can save audited GRANT scripts in a shared Collection, ensuring team-wide visibility and fast rollbacks.
Error 1045 (28000) - access denied: Triggered when a user matches but the password is wrong. Reset the password or update the client credentials.
Error 2003 (HY000) - can't connect to MySQL server: Indicates network reachability issues such as closed port 3306 or wrong hostname.
.
The server checks the mysql.user table. If no row matches your IP or hostname pattern, it returns Error 1130 before password authentication.
Yes, but it increases attack surface. If you must use '%', combine it with REQUIRE SSL or network firewalls.
No. Running FLUSH PRIVILEGES applies changes instantly without a restart.
Galaxy lets teams version GRANT scripts in shared Collections, review changes, and roll them out consistently, reducing misconfigurations.
.avif)
.avif){kind=logo}
