diff --git a/README.md b/README.md
index 2ec8299a7..52cb2373a 100644
--- a/README.md
+++ b/README.md
@@ -88,7 +88,7 @@ cd dootask
 ./cmd redis "your command"            # To run a redis command
 ./cmd composer "your command"         # To run a composer command
 ./cmd supervisorctl "your command"    # To run a supervisorctl command
-./cmd mysql "your command"            # To run a mysql command (backup: Backup database, recovery: Restore database)
+./cmd mysql "your command"            # To run a mysql command (backup: Backup database, recovery: Restore database, open: Open database external port access, close: Close database external port access)
 ```
 
 ### SSL configuration
diff --git a/README_CN.md b/README_CN.md
index 7e11b5e31..374b9a784 100644
--- a/README_CN.md
+++ b/README_CN.md
@@ -89,7 +89,7 @@ cd dootask
 ./cmd redis "your command"            # 运行 redis 命令
 ./cmd composer "your command"         # 运行 composer 命令
 ./cmd supervisorctl "your command"    # 运行 supervisorctl 命令
-./cmd mysql "your command"            # 运行 mysql 命令 (backup: 备份数据库，recovery: 还原数据库)
+./cmd mysql "your command"            # 运行 mysql 命令 (backup: 备份数据库，recovery: 还原数据库，open: 开启数据库外部端口访问，close: 关闭数据库外部端口访问)
 ```
 
 ### SSL 配置
diff --git a/cmd b/cmd
index 26c4c9d8f..6f9e42e0a 100755
--- a/cmd
+++ b/cmd
@@ -227,6 +227,55 @@ run_mysql() {
         run_exec mariadb "gunzip < /$inputname | mysql -u$username -p$password $database"
         run_exec php "php artisan migrate"
         judge "还原数据库"
+    elif [ "$1" = "open" ]; then
+        container_name=`docker_name mariadb`
+        if [ -z "$container_name" ]; then
+            error "没有找到 mariadb 容器!"
+            exit 1
+        fi
+        mkdir -p ${cur_path}/docker/mysql/tmp
+        cat > ${cur_path}/docker/mysql/tmp/${container_name}.conf <<EOF
+user nginx;
+worker_processes auto;
+error_log /var/log/nginx/error.log notice;
+pid /var/run/nginx.pid;
+events {
+    worker_connections 1024;
+}
+stream {
+    upstream mysql {
+        server ${container_name}:3306 max_fails=1 fail_timeout=30s;
+    }
+    server {
+        listen 3306;
+        proxy_pass mysql;
+        proxy_connect_timeout 5s;
+    }
+}
+EOF
+        read -rp "请输入代理端口（3300-65500）：" inputport
+        if [ $inputport -lt 3300 ] || [ $inputport -gt 65500 ]; then
+            error "端口范围不正确！"
+            exit 1
+        fi
+        run_mysql rm-port
+        docker run --name ${container_name}-port \
+            --network dootask-networks-$(env_get APP_ID) \
+            -p ${inputport}:3306 \
+            -v ${cur_path}/docker/mysql/tmp/${container_name}.conf:/etc/nginx/nginx.conf \
+            -d nginx:alpine > /dev/null
+        judge "开启代理"
+    elif [ "$1" = "close" ]; then
+        container_name=`docker_name mariadb`
+        if [ -z "$container_name" ]; then
+            error "没有找到 mariadb 容器!"
+            exit 1
+        fi
+        docker stop ${container_name}-port > /dev/null
+        docker rm ${container_name}-port > /dev/null
+        judge "关闭代理"
+    elif [ "$1" = "rm-port" ]; then
+        docker rm -f $(docker_name mariadb)-port &> /dev/null
     fi
 }
 
@@ -421,6 +470,7 @@ if [ $# -gt 0 ]; then
             exit 2
             ;;
         esac
+        run_mysql rm-port
         $COMPOSE down
         env_set APP_DEBUG "false"
         rm -rf "./docker/mysql/data"
@@ -518,6 +568,10 @@ if [ $# -gt 0 ]; then
             run_mysql backup
         elif [[ "$1" == "recovery" ]] || [[ "$1" == "r" ]]; then
             run_mysql recovery
+        elif [[ "$1" == "agent" ]] || [[ "$1" == "open" ]]; then
+            run_mysql open
+        elif [[ "$1" == "unagent" ]] || [[ "$1" == "close" ]]; then
+            run_mysql close
         else
             e="mysql $@" && run_exec mariadb "$e"
         fi
@@ -545,6 +599,9 @@ if [ $# -gt 0 ]; then
         $COMPOSE stop "$@"
         $COMPOSE start "$@"
     else
+        if [[ "$1" == "down" ]]; then
+            run_mysql rm-port
+        fi
         $COMPOSE "$@"
     fi
 else
diff --git a/docker-compose.yml b/docker-compose.yml
index afc1576cd..c576b5ff3 100755
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -63,8 +63,6 @@ services:
   mariadb:
     container_name: "dootask-mariadb-${APP_ID}"
     image: "mariadb:10.7.3"
-    ports:
-      - "${DB_OPEN_PORT:-}:3306"
     volumes:
       - ./docker/mysql/repassword.sh:/etc/mysql/repassword.sh
       - ./docker/mysql/conf.d:/etc/mysql/conf.d
diff --git a/docker/mysql/.gitignore b/docker/mysql/.gitignore
index a36272c18..69905377c 100644
--- a/docker/mysql/.gitignore
+++ b/docker/mysql/.gitignore
@@ -1,3 +1,4 @@
 data
 backup
 bak
+tmp