Error: Host Is Blocked Because of Many Connection Errors

Issue

Connection tests or syncs for an Amazon RDS for MySQL connection using AWS PrivateLink fail with the following error:

Host '10.50.46.137' is blocked because of many connection errors; unblock with 'mysqladmin flush-hosts'

In the PERFORMANCE_SCHEMA.HOST_CACHE table, the count_handshake_errors value has reached the configured limit for an internal IP address in the AWS PrivateLink Network Load Balancer (NLB) range.

Environment

• Connector: Amazon RDS for MySQL
• Connection method: AWS PrivateLink

Resolution

To resolve this issue:

1. Run mysqladmin flush-hosts to temporarily unblock the IP address. The IP may be blocked again if the failed connection attempts continue.
2. Change the NLB health check to use a port that doesn't expect a MySQL handshake, if your infrastructure supports this configuration. This prevents MySQL from treating health checks as failed connection attempts. Ensure the health check port is not used for MySQL RDS data traffic.
3. Verify that your PrivateLink setup correctly points to the intended NLB and doesn't expose MySQL to unnecessary health checks. For setup guidance, see AWS PrivateLink.
4. Confirm that your NLB security group settings allow traffic only from authorized sources and on required ports.
5. Review the MySQL logs for recurring failed connection attempts that correspond to when the errors occur.
6. In Fivetran, run the connection tests again.

Cause

This issue occurs when the AWS NLB performs TCP health checks on the MySQL port, typically 3306.

The NLB completes the TCP handshake and then closes the connection without transmitting data or completing the MySQL greeting and authentication sequence. MySQL records each attempt as an incomplete handshake and increments the count_handshake_errors counter for that NLB IP address. When the counter reaches the max_connect_errors threshold, MySQL blocks the NLB IP address, preventing legitimate Fivetran traffic from reaching the database.