Frewalld. Problems with IP limit (mysql)?

Question

MySQL

Greetings!
It is required to make a whitelist of IPs that can connect to mysql (interact with port 3306 (mysql service)).
You can of course set up privileges on mysql itself, but I want to close connections before interacting with mysql, i.e. write rules in firewalld.
How do I do.
-
Add service:
firewall-cmd --zone=public --add-service=mysql --permanent
Then add rules:
firewall-cmd --add-rich-rule 'rule family="ipv4" source address="REMOTE_IP" service name="mysql" accept' --permanent
And reload:
firewall-cmd --reload
-
But connecting from a third-party IP is allowed via telnet:
telnet IP 3306
The connection is not immediately reset, but displayed:
Version(Set of obscure characters) mysql_native_password
I.e. firewalld did not take the required action, but skipped it.
I will be grateful for your help!

Answer 1

I add a service:
firewall-cmd --zone=public --add-service=mysql --permanent

Adding a service to firewalld means that you open ports for that service to everyone. Just remove this rule and everything will be ok

Answer 2

Where is the prohibition rule?
Look, you first allow access to the service for everyone, then re-allow access from one address, ... But there is no ban.