Except that you cannot, because if you remove it from the query guest group (which everyone is a guest when first connecting to the server query), you do not have the permission to login. As such you cannot login to get any additional permissions.
Just removing the permissions from all groups does not break that you can not build a connection to the Query.
Does the server start at all with your old db? Pleas read or show server log 0.
That’s what I thought.
But there is no firewall but the debian IP tables and those (currently) allow all traffic.
The servers network interface has the public IP assigned.