> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/server/reference/error-codes/mariadb-error-codes-1100-to-1199/e1130.md).

# Error 1130: Host is not allowed to connect to this MariaDB server

| Error Code | SQLSTATE | Error                     | Description                                                |
| ---------- | -------- | ------------------------- | ---------------------------------------------------------- |
| 1130       | HY000    | ER\_HOST\_NOT\_PRIVILEGED | Host '%s' is not allowed to connect to this MariaDB server |

## Possible Causes and Solutions

The server checks the client's host before it reads the user name or the password. It returns this error when no account at all has a [host name component](/docs/server/reference/sql-statements/account-management-sql-statements/create-user.md#host-name-component) that matches the client's host name or IP address. Because of that, the error doesn't depend on the user name you connect with.

If at least one account matches the client's host, the server goes on to check the user name and the password, and a wrong user name gives [error 1045](/docs/server/reference/error-codes/mariadb-error-codes-1000-to-1099/e1045.md) instead. For example, with an account `app@'10.0.0.%'` and other accounts for `localhost`, connecting as `app` from `localhost` fails with error 1045, not 1130.

To solve the error:

* Create an account for the client's host or network, for example `CREATE USER 'app'@'192.168.1.%' IDENTIFIED BY '…';`, or check the host name component of the existing account.
* Check which host the server sees. The error message names it. When [skip\_name\_resolve](/docs/server/server-management/variables-and-modes/server-system-variables.md#skip_name_resolve) is on, the server compares only IP addresses, so accounts for `localhost` or for a host name don't match a TCP connection. A TCP connection from the same machine then arrives as `127.0.0.1` or `::1`.
* If the client connects through a proxy that sends a PROXY protocol header, the same error code comes with the message `Proxy header is not accepted from <address>`. Add the address of the proxy to [proxy\_protocol\_networks](/docs/server/server-management/variables-and-modes/server-system-variables.md#proxy_protocol_networks).

{% hint style="info" %}
The server sends this error before the TLS handshake. A client that requests TLS, as the `mariadb` client does by default, can't verify where the error came from, and reports it as error 2002 with the server's error inside the message:

```
ERROR 2002 (HY000): Received error packet before completion of TLS handshake. The authenticity of the following error cannot be verified: 1130 - Host '127.0.0.1' is not allowed to connect to this MariaDB server
```

{% endhint %}

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>

{% @marketo/form formId="4316" %}