You can reach a MySQL server without opening MySQL’s port to the public Internet by creating an SSH local port forward. Run ssh -N -L 127.0.0.1:13306:127.0.0.1:3306 [email protected] on your computer, keep that session open, and point your MySQL client to 127.0.0.1 on port 13306. MySQL credentials remain separate from SSH credentials.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The SSH host must be able to reach the MySQL destination. That destination can be MySQL on the SSH host itself or a different private server reachable from it. The tunnel encrypts the connection carried through SSH while allowing MySQL to stay inaccessible from the public Internet.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What an SSH tunnel changes
A normal remote MySQL connection sends the client directly to a database address and port. An SSH tunnel changes the route:
- Your MySQL program connects to a local listening port on your computer.
- SSH carries that connection to the SSH server through an encrypted session.
- The SSH server opens a connection to the destination host and port from its own network.
OpenSSH defines this as local forwarding: a local TCP port is forwarded to a host and port on the remote side. Oracle describes the mechanism as an encrypted SSH tunnel in its port-forwarding guide; the forwarding options are documented in the OpenSSH manual.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
MySQL itself can remain bound to a private interface or protected by a firewall. The only service that must be reachable from your computer is SSH.
Prerequisites and network layout
Accounts and reachability
- An SSH account that can log in to a host.
- Network access from that SSH host to the MySQL destination and port.
- A MySQL account with permission to authenticate from the connection source that MySQL sees.
- An unused local TCP port, such as
13306. - An OpenSSH client, or a GUI/operating-system tool that creates an equivalent local forward.
First decide where MySQL is located relative to the SSH server:
- MySQL on the SSH host: use
127.0.0.1:3306as the destination. That loopback address is evaluated on the SSH host. - MySQL on another private host: use that server’s private DNS name or address, for example
db.internal.example:3306. The SSH host must be able to resolve and reach it.
The client computer does not interpret the destination part of the command. In local_port:destination_host:destination_port, only local_port belongs to the client machine; the destination is contacted from the SSH server’s network.
Open an SSH local forward with OpenSSH
1. Choose a local port
Pick a free port that is not already used by another service. Port 13306 is only an example; it does not change MySQL’s server port. If you already run another local forward on that port, choose a different one such as 13307.
2. Start the tunnel
From a terminal on the client computer, run:
ssh -N -L 127.0.0.1:13306:127.0.0.1:3306 [email protected]Replace sshuser with the SSH login name and ssh.example.com with the SSH server name or address. The options mean:
-Nrequests no remote command. SSH exists only to carry forwarding traffic.-Lcreates a local forward.127.0.0.1:13306is the address and port opened on your computer.127.0.0.1:3306is the address and port contacted from the SSH server.
Authenticate to SSH when prompted, using the account’s password or key. A successful login normally leaves the command running without returning to a shell prompt. That running process is the tunnel; do not close its terminal while using MySQL.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Forward to a separate private database host
If MySQL is on a private server reachable from the SSH host, change only the destination fields. For example:
ssh -N -L 127.0.0.1:13306:db.internal.example:3306 [email protected]Here, db.internal.example must resolve from ssh.example.com, and firewalls must allow the SSH host to connect to port 3306 on that database server. You still connect your local MySQL program to 127.0.0.1:13306.
4. Connect with a MySQL client
In a second terminal or application, set:
- Host:
127.0.0.1(orlocalhost) - Port:
13306, or the local port you selected - Username and password: your normal MySQL credentials
Do not enter the SSH server name as the MySQL host. Do not enter the database server’s private address in the client either; the local listener is the endpoint your client can see.
5. Close the tunnel
When finished, stop the SSH process with Ctrl-C in its terminal. If a tunnel is required for a long-running task, manage the SSH process with your operating system’s service or session tools and monitor it for disconnects. A tunnel that has exited no longer provides a listening port.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUsing MySQL Workbench and other GUI clients
Configure the GUI as though MySQL were running locally:
- Create or edit the MySQL connection profile.
- Set the host to
127.0.0.1orlocalhost. - Set the port to the local forwarded port, such as
13306. - Enter the MySQL username and password, not the SSH password.
- Start the SSH command first, then test the GUI connection.
Oracle’s Windows SSH procedure uses this same arrangement: establish SSH port forwarding, log in through SSH, and configure the client or ODBC application for localhost rather than the remote server name. The mapping is the same for MySQL Workbench and other GUI tools that let you specify a host and TCP port.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
If the GUI has its own SSH-tunneling feature, it may ask for two sets of values: SSH host, port, user, and key/password; and MySQL host, port, user, and password. In that mode, the MySQL host is still the database address as viewed from the SSH server. If you create the tunnel manually, use the local host and local forwarded port in the GUI instead.
How binding affects exposure
The command binds the listener to 127.0.0.1. This limits connections to the client computer. The OpenSSH manual states that binding to localhost is for local use; an empty bind address or * can make the listener available on all interfaces.
That distinction matters on shared workstations, development laptops, and machines connected to untrusted networks. A forward such as:
ssh -N -L 13306:127.0.0.1:3306 [email protected]may listen beyond loopback depending on the SSH client’s defaults and platform. Prefer the explicit loopback form:
ssh -N -L 127.0.0.1:13306:127.0.0.1:3306 [email protected]Binding locally does not grant database access by itself. Anyone who can use the SSH account and anyone who can reach an intentionally exposed listener still needs valid MySQL credentials, but reducing the listener’s network scope removes an unnecessary attack path.
Which side resolves each address?
| Value | Where it is interpreted | Typical value |
|---|---|---|
| Local bind address | Your client computer | 127.0.0.1 |
| Local port | Your client computer | 13306 |
| Destination host | SSH server’s network | 127.0.0.1 or a private database hostname |
| Destination port | SSH server’s network | 3306, if MySQL listens on its default port |
This viewpoint explains a common mistake. If the database is on a different private machine, 127.0.0.1 in the destination means the SSH machine, not the database machine. Use the database’s private address or DNS name instead.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
MySQL authentication is still required
SSH authentication and MySQL authentication are separate. Successfully logging in to ssh.example.com does not log you in to MySQL. After the tunnel is established, MySQL performs its ordinary username, password, account-host, and privilege checks.
The account-host check can appear different from a direct connection because MySQL receives the connection from the SSH host or from the destination network path. Confirm that the MySQL account is allowed from the source that the server actually sees. Do not solve an account-host problem by granting broad privileges or opening MySQL publicly; correct the account definition and network policy instead.
Use a dedicated SSH account where practical, protect private keys with appropriate operating-system permissions, and verify the SSH server’s host key. Keep MySQL privileges narrowly scoped to the databases and operations the user needs.
What the tunnel encrypts—and what it does not
“Do not transmit plain (unencrypted) data over the Internet. This information is accessible to everyone who has the time and ability to intercept it.”
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
That warning appears in Oracle’s MySQL Security Guidelines, which identify SSH port forwarding as an encrypted and compressed tunnel technique. The SSH session protects the network leg carried between your client and the SSH server. It does not replace MySQL authentication, host-key verification, firewall controls, operating-system hardening, or least-privilege database design.
MySQL Shell describes the model as follows: “An SSH tunnel lets unencrypted traffic pass over an encrypted connection, and enables authorized remote access to servers that are protected from outside connections by a firewall.” In practical terms, MySQL traffic can travel inside the encrypted SSH connection even when the database is not directly exposed. If the final hop from the SSH server to a separate database host traverses a network that requires encryption, configure MySQL’s own TLS protections as well; SSH only covers the path inside the tunnel.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.MySQL Shell’s built-in SSH support
MySQL Shell supports SSH tunneling with an SSH-server URI and a separate MySQL-server uri. Its documentation says not to put the MySQL host and port in the base connection parameters when using SSH tunneling; provide the target in uri instead. Follow the syntax and option names in the MySQL connection-parameters documentation.
Avoid embedding passwords in a connection specification. The same documentation warns that explicit passwords are insecure and recommends interactive prompting. Keep SSH keys protected and use the shell’s prompt or a secure credential mechanism rather than placing secrets in shell history, scripts, process lists, or shared configuration files.
Free tools Windows power users keep installed
One-click scans. No signup required.
When to choose MySQL Shell support
- Use it when your workflow already runs in MySQL Shell and you want the tunnel represented in the shell’s connection configuration.
- Use a manual OpenSSH forward when several different clients must share one local endpoint, when you need a simple OS-level process, or when your GUI does not understand MySQL Shell connection specifications.
- Check feature compatibility before adopting SSH tunneling for AdminAPI work. MySQL Shell’s manual states that AdminAPI commands are not supported over SSH-tunneled connections except for deployment, start, stop, kill, and delete operations for sandbox instances.
That AdminAPI limitation is significant for InnoDB Cluster and related administration workflows. A tunnel can be suitable for ordinary SQL access while still being unsuitable for the complete set of cluster-management commands you planned to run.
Manual OpenSSH versus MySQL Shell SSH support
| Consideration | Manual OpenSSH local forward | MySQL Shell SSH support |
|---|---|---|
| Client compatibility | Any MySQL client or GUI that can connect to a local TCP host and port | MySQL Shell connection workflow |
| Local endpoint | You choose and bind a local port such as 127.0.0.1:13306 |
Managed through the shell’s SSH-server and MySQL-server connection parameters |
| Credential handling | SSH authentication and MySQL authentication are entered separately | Documentation recommends interactive password prompting and warns against explicit passwords in specifications |
| Automation | Can be managed as an operating-system process or session | Configured within MySQL Shell’s connection model |
| AdminAPI | Client compatibility alone does not remove MySQL Shell’s AdminAPI restrictions | AdminAPI over SSH-tunneled connections is limited to the documented sandbox deployment, start, stop, kill, and delete operations |
Neither approach changes the underlying network requirement: the SSH server must be able to reach the MySQL destination.
Troubleshooting by symptom
“Connection refused” on the local port
- Check that the SSH process is still running and did not exit after an error.
- Confirm the local port is free. Change
13306to another unused port and update the GUI or client accordingly. - Read the SSH terminal output for a bind failure or forwarding error.
- Verify that you used the loopback address and the intended local port in the MySQL client.
SSH logs in, but MySQL cannot connect
- From the SSH host, test whether the destination hostname resolves and whether its MySQL port is reachable.
- Check that MySQL is listening on the destination interface and port, not only on an address the SSH host cannot use.
- Confirm that the MySQL account permits the connection source observed by the database.
- For a database on another private host, replace destination
127.0.0.1with that host’s private name or address.
The connection times out
- Inspect firewall rules between the SSH host and the MySQL host.
- Verify DNS resolution from the SSH host, not only from your local computer.
- Check security groups, routing, and the MySQL listener address on the private network.
Authentication fails
Determine which credential failed. SSH credentials authenticate the tunnel endpoint; MySQL credentials authenticate the database session. A valid SSH key does not substitute for a MySQL password, and a valid MySQL password does not grant SSH access. Avoid putting either password in a URI or shell history.
The GUI connects to the wrong place
Inspect the saved connection profile. For a manually created tunnel, it must use 127.0.0.1 or localhost and the local forwarded port. If it uses the database’s private or public hostname, it bypasses the local listener and may fail or reach a different service.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Operational and security checklist
- Keep MySQL off the public Internet when SSH is the intended access path.
- Restrict SSH access to required users and verify host keys before authenticating.
- Use a dedicated SSH account where feasible and protect its private keys.
- Bind local forwards to
127.0.0.1unless there is a documented reason to expose the listener to another interface. - Use separate, least-privilege MySQL accounts and retain normal MySQL authentication.
- Document which local port maps to which destination so that a GUI profile cannot silently target the wrong database.
- Monitor long-lived tunnels; an exited SSH process means the local port is no longer forwarded.
- For sensitive traffic on the SSH-host-to-database leg, evaluate MySQL TLS in addition to SSH.
End-to-end example
Assume the following topology:
- Your laptop is the client.
jump.example.comis reachable by SSH as useradminssh.- MySQL runs on that same host at
127.0.0.1:3306. - Port
13306is free on the laptop.
- Run
ssh -N -L 127.0.0.1:13306:127.0.0.1:3306 [email protected]. - Leave that terminal open after SSH authentication succeeds.
- Open your MySQL client and choose host
127.0.0.1, port13306. - Enter the intended MySQL username and password.
- When the work is complete, stop the SSH process.
If MySQL instead runs on db.private.example behind the jump host, keep every client setting the same and change the command’s destination to db.private.example:3306. The jump host must have both DNS and network access to that database.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
