MySQL "ERROR 1130: Host is not allowed to connect": an account is a user and a host

1. Look at the accounts

Get in locally, where you do have an account:

sudo mysql

SELECT user, host FROM mysql.user ORDER BY user, host;

+------------------+-----------+
| user             | host      |
+------------------+-----------+
| app              | localhost |
| mysql.sys        | localhost |
| root             | localhost |
+------------------+-----------+

So app can only log in from the server itself. The address in your error is what MySQL sees, which is worth checking. Behind a NAT, a load balancer or in Docker, it may not be the address you expected.

2. Create an account for that host

Use an account for the application, not root:

CREATE USER 'app'@'10.0.0.20' IDENTIFIED BY 'new-password-here';
GRANT SELECT, INSERT, UPDATE, DELETE ON shop.* TO 'app'@'10.0.0.20';

The Password Generator gives you a strong password, with a shell-safe option that won’t need escaping in a config file.

The host can also be a range, with % as a wildcard:

Prefer the narrowest that works. To see what an account can do:

SHOW GRANTS FOR 'app'@'10.0.0.20';

Old guides show GRANT ... IDENTIFIED BY. That creates a user in one step, and it was removed in MySQL 8, where it gives a syntax error. Use two statements, as above.

3. Test it

From the machine that’s connecting:

mysql -h 10.0.0.5 -u app -p shop

If you now get ERROR 1045: Access denied, then the account exists and the password doesn’t match: see MySQL error 1045. That’s progress.

4. Docker

Here the problem has a twist. The host MySQL sees is the container’s or bridge’s address, such as 172.18.0.3, and it can change whenever the container is recreated. The official image handles this if you let it create the user, as it uses '%':

services:
  db:
    image: mysql:8.4
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_DATABASE: shop
      MYSQL_USER: app
      MYSQL_PASSWORD: ${DB_PASSWORD}

Those variables only work the first time, on an empty data folder. If the volume already exists, changing them does nothing, and that’s a common cause of confusion. Either create the account by hand as in section 2, or remove the volume if there’s nothing to keep.

Don’t publish the database’s port for other containers: they connect by name. See connecting to localhost from a container.

5. Name lookups

Host 'ip-10-0-0-20.ec2.internal' is not allowed means MySQL looked up a name for your address, and matched on that. Slow connections can come from those lookups as well. To use addresses only, set this, and then accounts must use addresses too:

[mysqld]
skip_name_resolve = ON

It’s a good setting, and it needs a restart, so check your accounts first, as any account with a name for a host stops matching.

6. Too many failed attempts

A similar error appears after many broken connections:

ERROR 1129 (HY000): Host '10.0.0.20' is blocked because of many connection errors

That’s a different thing, with a different fix:

TRUNCATE TABLE performance_schema.host_cache;

Or mysqladmin flush-hosts. Then find out what keeps failing, as it’s often a health check that connects and drops.