I regularly forward mysql ports over ssh, so they don't need to be exposed to a public IP address.