Access denied for user 'repl_user'@'' but where ip coming from?



On one of the node I setup master with following:

CHANGE MASTER TO MASTER_HOST = '',  MASTER_USER = 'repl_user', MASTER_PASSWORD = 'repl123',  MASTER_LOG_FILE = 'mysql-bin.000002', MASTER_LOG_POS = 842;

this worked in the past, but now I am getting this strange error:

*************************** 1. row ***************************
               Slave_IO_State: Connecting to master
                  Master_User: repl_user
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: mysql-bin.000002
          Read_Master_Log_Pos: 842
               Relay_Log_File: mysqld-relay-bin.000001
                Relay_Log_Pos: 4
        Relay_Master_Log_File: mysql-bin.000002
             Slave_IO_Running: Connecting
            Slave_SQL_Running: Yes
                   Last_Errno: 0
                 Skip_Counter: 0
          Exec_Master_Log_Pos: 842
              Relay_Log_Space: 249
              Until_Condition: None
                Until_Log_Pos: 0
           Master_SSL_Allowed: No
        Seconds_Behind_Master: NULL
Master_SSL_Verify_Server_Cert: No
                Last_IO_Errno: 1698
                Last_IO_Error: error connecting to master 'repl_user@' - retry-time: 60  maximum-retries: 86400  message: Access denied for user 'repl_user'@''
               Last_SQL_Errno: 0
             Master_Server_Id: 0
                   Using_Gtid: No
                Parallel_Mode: conservative
1 row in set (0.00 sec)

The Slave status shows:

Last_IO_Error: error connecting to master 'repl_user@' - retry-time: 60  maximum-retries: 86400  message: Access denied for user 'repl_user'@''

but where is this ‘repl_user’@’’ coming from ?

I have this user setup as :

MariaDB [(none)]> select user,host from mysql.user where user = 'repl_user';
| user      | host |
| repl_user | %    |

I do not have any node on any subnet 10.0.x.x .


The reason of the error is straightforward: the primary host sees the replica connection as coming from

Why this happens, I can’t say. One distinct possibility is that your replica is on a subnet of its own – say, – that the master; and the connection is made through a NAT (or a VPN of some kind): (your PC) --- (local gateway)
                      (remote gateway)

To check this out, on the replica machine, run:

traceroute -n

and see what that tells you.

Verify that the replica machine only has the one interface 192.168.1.x and there is no 10.0.0.x interface lurking.

Then, verify the routing tables to ensure they’re correct (I’d be surprised if they weren’t, but I have seen things happen).

If nothing avails, I must conclude that technically the server is on the same network segment as the replica, as you say, but actually it is not: it could be, for example, inside a virtual machine environment, or protected by a firewall. An "address cloning" setup like this is very unusual, and prone to problems, but not impossible: (replica) ----- (VM Host)
                       (internal dispatcher)
                       (MariaDB primary) (replica) ----- (Firewall external)
                       (Firewall internal)
                    (MariaDB primary)

These kind of setups might even be detectable (or not) only with tools like hping and careful tracerouting (so-called "firewalking"), assuming no great care has been taken to hide the fact that the server addressing isn’t what it seems to be. For example, TTL measurements to port 3306 of might be off and reveal that the packets actually passed through one or two extra nodes that shouldn’t have been there.

All this, however, could be more easily discovered by asking the NetOps guys, and is just a curiosity – what matters to you is making the replica work, and for that, as things stand, you need to authorize


For example, my own PC here is Were I to connect to a primary on, that would happen through a NATting gateway for the 192.168.200.x subnet, which is (on my side) and (on the other side). So, the primary would see my replica request coming from

And that would be the address I’d have to authorize if I wanted the replica to work.

By the same token, you need to authorize replica from

And yes, that means that any PC in my 192.168.100.x network would then be authorized to connect to that master. To organize things differently, the network routing must be changed.

I could for example ask for a VPN connection so that my PC receives an address in the 192.168.200.x range. Packets would be encapsulated, sent to (obviously), arrive at on port 1194, and there "reinflated" and given source address maybe. Then the primary would see "me" as and I would need to authorize that address, reserved for my personal use.

Answered By – LSerni

This Answer collected from stackoverflow, is licensed under cc by-sa 2.5 , cc by-sa 3.0 and cc by-sa 4.0

Leave A Reply

Your email address will not be published.

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More