I have a bunch Raspberry Pis collecting data from behind client firewalls. I want to start sending this data to MYSQL server. Because the Raspberry Pis do not have static IP addresses, I obviously feel vulnerable opening up my database to the public. For SSH we have Fail2Ban, but for MYSQL I have found no documentation or recommended equivalent. Is it possible or even desirable to set up Fail2Ban for MYSQL in this context?
My alternatives seem to be a mix of using a VPN, wildcard IP addresses, and port knocking. I'm not too fond of having potentially insecure RPis connecting to my server via SSH if I can help it. I imagine the best approach is strict IP banning.