An AMX Mod X SQL plugin logs that it cannot connect to the MySQL server with error 111. Unlike an access-denied error, this one never even reached the login stage: errno 111 is ECONNREFUSED, the operating system telling you nothing is listening at that address and port, or a firewall dropped the connection. No password is involved. The fix is entirely about the network path between the game server and MySQL — making MySQL listen where the plugin is dialing, and letting the packet through.
1. Read the error and what 111 means
The AMXX log shows something like:
Can't connect to MySQL server on '203.0.113.10' (111)
The (111) is the system error code for "connection refused." It means the game server sent a connection to that host and port and got an immediate rejection — there was no service accepting it. Common causes, in order of likelihood: MySQL is bound to loopback only, MySQL is not running, the wrong port is being dialed, or a firewall is blocking 3306.
2. Check MySQL's bind-address
By default many MySQL/MariaDB installs listen only on 127.0.0.1. That is fine when the game server and database are the same box and the plugin connects to 127.0.0.1. But if the plugin connects to a LAN or public IP, MySQL bound to loopback refuses it — errno 111. In the server config (commonly my.cnf / 50-server.cnf):
bind-address = 0.0.0.0
Binding to 0.0.0.0 makes it listen on all interfaces; restart MySQL afterward. Also make sure skip-networking is not set — that option disables TCP entirely and guarantees a refused connection from anything but a local socket.
3. Confirm MySQL is actually running and on which port
A refused connection can simply mean the service is down or on a non-default port. On the database host, confirm MySQL is up and listening on the port the plugin dials (default 3306). If the plugin's amx_sql_host includes a non-standard port, it must match where MySQL listens. A mismatched port produces the exact same errno 111.
4. Open the firewall between the two hosts
Even with MySQL listening on all interfaces, a firewall between the game server and the database will refuse or drop 3306. Allow it:
- On the database host, permit inbound TCP 3306 from the game server's IP (prefer a specific source IP over opening it to the world).
- Check both a local firewall (
ufw/iptables) and any provider/cloud security group. - Do not expose 3306 to the whole internet — scope it to the game server's address.
5. Prove the path independently of the plugin
Before touching the plugin again, test raw connectivity from the game server host to the database. A simple TCP probe to the database IP on 3306, or the MySQL command-line client pointed at that host, will either connect (proving the path is open, so the remaining issue is credentials) or be refused (confirming 111 is still a network problem). This separates "can I even reach MySQL" from "will MySQL let me log in," and stops you debugging the wrong layer. If the probe from the game server is refused but the same probe from the database host itself succeeds, you have proven the problem is between the two machines — a firewall or a loopback-only bind — and not the database being down.
Troubleshooting
- Works with
127.0.0.1, fails with the real IP — MySQL is bound to loopback only. Setbind-address = 0.0.0.0and restart. - Refused even locally — MySQL is not running, or
skip-networkingis on. Start the service and removeskip-networking. - Connects from the DB host but not the game server — a firewall between them blocks 3306. Allow the game server's IP.
- Intermittent 111 — MySQL restarting/crashing under load, or hitting
max_connectionsand refusing new ones. Check the MySQL error log. - Reaches MySQL now but is rejected — that is progress: you moved from errno 111 to an auth error. Continue with access denied for user.
Verification
From the game server host, run the raw connectivity test again — a successful TCP handshake to the database on 3306 means errno 111 is resolved. Then change the map to reconnect the plugin and watch addons/amxmodx/logs/: the (111) line should be gone. If it now shows an access-denied message instead, you have succeeded at the network layer and only need to fix credentials. The definitive success signal is the plugin writing to and reading from the database during normal play — a stats row after a kill, a ban row after a test ban.
