Introduction

Can't connect to MySQL server with error 111 usually means the client attempted a TCP connection and the target refused it. In Linux environments this often maps to "connection refused," which points to a server process that is down, listening on the wrong interface or port, or blocked by network rules.

Core Sections

Start With the Simplest Check

Before digging into grants or application code, verify that MySQL is actually running.

sudo systemctl status mysql

On some systems the service name is mysqld instead:

sudo systemctl status mysqld

If the service is stopped, start it and retry the connection.

sudo systemctl start mysql

You can then test a direct client connection:

mysql -h 127.0.0.1 -P 3306 -u root -p

Using 127.0.0.1 forces TCP. That matters because localhost may use a Unix socket instead, which can hide a TCP-specific problem.

Confirm the Port and Listening Address

If MySQL is running but still refusing connections, check whether it is listening on the address and port you expect.

sudo ss -ltnp | grep 3306

Typical outputs tell you a lot:

• '127.0.0.1:3306 means local TCP connections work, but remote hosts cannot connect.'
• '0.0.0.0:3306 means the server is listening on all IPv4 interfaces.'
• no output often means MySQL is not listening on TCP at all.

Then inspect the MySQL configuration, often in my.cnf, mysqld.cnf, or a file under conf.d.

[mysqld]
port = 3306
bind-address = 127.0.0.1

If bind-address is 127.0.0.1, remote connections are intentionally blocked. For remote access, administrators often change it to 0.0.0.0 or to a specific private IP, then restart MySQL.

sudo systemctl restart mysql

Check Firewall and Network Policy

Even a correctly running server can be unreachable if the host firewall blocks port 3306.

For ufw:

sudo ufw status
sudo ufw allow 3306/tcp

For firewalld:

sudo firewall-cmd --list-ports
sudo firewall-cmd --permanent --add-port=3306/tcp
sudo firewall-cmd --reload

In cloud environments, remember that security groups or VPC firewall rules can block the same port even if the machine-level firewall is open.

Verify User Grants for Remote Access

A refused connection and an authentication error are not the same thing, but grant configuration still matters once the port is reachable. If the user only exists as 'appuser'@'localhost', remote login from another host will fail even when the server is up.

You can inspect accounts from a privileged MySQL session:

SELECT user, host
FROM mysql.user
ORDER BY user, host;

To permit a user from a specific network:

CREATE USER 'appuser'@'10.0.0.%' IDENTIFIED BY 'strong-password';
GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'10.0.0.%';
FLUSH PRIVILEGES;

Use the narrowest host pattern you can. Opening MySQL to every address is usually unnecessary and risky.

Application Connection String Problems

Sometimes MySQL is healthy and the real problem is the client configuration. Common mistakes include:

• wrong hostname
• wrong port
• using localhost when the application expects TCP
• containerized app trying to connect to itself instead of the database service

For example, inside Docker Compose, localhost usually points to the application container, not the MySQL container. The correct host is often the service name, such as db.

Common Pitfalls

• Treating error 111 like an authentication failure instead of a TCP connectivity problem.
• Testing with localhost and forgetting that it may use a Unix socket rather than TCP.
• Updating MySQL bind-address without also checking host firewalls or cloud security rules.
• Exposing port 3306 publicly when the database should really stay on a private network.
• Blaming application code before confirming that the server is actually running and listening on the expected port.

Summary

• Error 111 usually means the TCP connection was refused.
• Check whether MySQL is running before changing application code.
• Verify the listening address and port with ss or a similar tool.
• Review firewalls, cloud security rules, and MySQL bind-address together.
• Once connectivity works, confirm that the MySQL user is allowed from the connecting host.