What is the correct method to access MySQL remotely?

Question

MySQL

What is:

• 1 rack MySQL server
  
• Dynamic number of clients (50-150 computers, some on, some off) that should work with this database. Clients are geographically distributed, but have a stable Internet connection. Some clients work in the mode of 1 request per 5-10 seconds, others generate 20-30 requests per second around the clock.
  

The question itself: how to organize the connection of clients to the database?
Already considered, but there are questions:

• API layer (not suitable due to too much redesign of the client architecture + additional server in the rack)
  
• Put MySQL "booty" on the Internet (the whole Internet is replete with the fact that this is not safe, they don’t say what exactly, except for brute force)
  
• SSH tunnel (no personal experience of checking it for stability and reconnects like autossh)
  
• VPN (no personal experience testing it for stability)
  
• maybe there is more...
  

ps Clients do not have a permanent ip

Answer 1

vpn is the most correct solution, as the name itself hints - a virtual private network. That is, an emulation of work in the internal network is created for remote users. There is a sssh from a caropka.

Answer 2

Maybe IPTables ? If the client IPs are known and constant, open 3306 only for them, and close the rest of the ports for other addresses.

Answer 3

Expose MySQL "booty" to the Internet

- it's not scary. We give access to the necessary addresses with a firewall (they must be static) and close it for the rest . You can also configure mysql VPN encryption
between points - in case the clients have dynamic addresses, then mysql encryption is not needed. The channel must already be encrypted