What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use MySQL Workbench’s Standard TCP/IP over SSH connection method. It logs in to the VPS through SSH, then carries the MySQL session through that encrypted connection, so MySQL can remain bound to a private or loopback interface instead of accepting Internet connections on port 3306.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
You will enter two independent sets of credentials: an SSH username and key for the Linux account, plus a MySQL username and password for the database account. In Workbench, set SSH Hostname to the VPS address, but set MySQL Hostname to the address the database exposes to the VPS—normally 127.0.0.1 or localhost when MySQL runs on that same server.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat the SSH tunnel changes
A normal MySQL client connection opens a TCP session directly to a MySQL listener. With an SSH tunnel, Workbench first authenticates to the VPS over SSH. The SSH server then opens a connection from the VPS to the MySQL host and port you specify. Database traffic travels inside the encrypted SSH session between your computer and the VPS.
The two ends therefore have different meanings:
- SSH Hostname is the public DNS name or IP address of the VPS and may include a non-standard SSH port.
- MySQL Hostname is resolved from the VPS side of the tunnel. It is usually
127.0.0.1orlocalhostwhen the database service is on the same VPS.
That distinction is why entering the VPS’s public address in both fields often fails. A MySQL service bound only to loopback is intentionally reachable from the server itself, not from the public network.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites and the secure target design
Before opening Workbench, make sure the server and your client meet these requirements:
- A running MySQL server on the VPS, with its listening port known. The conventional port is
3306, but use the configured value if it differs. - An SSH daemon reachable from your network, including its actual port if it is not
22. - A non-root Linux account for administration. Its public key must be in that account’s
authorized_keysfile. - The matching private key on the computer running Workbench, in OpenSSH format.
- Firewall rules that allow SSH from your network while leaving MySQL’s port private whenever the database and tunnel endpoint are on the same VPS.
- A MySQL account with the privileges needed for the work you intend to perform.
The safest common layout is to expose only SSH publicly and keep MySQL listening on a local or private interface. Workbench reaches MySQL from the VPS side of the tunnel, so the database does not need a second public firewall opening.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Create or verify a dedicated SSH account
Use a named administrative account rather than the root account. Install your public key for that user and confirm that the SSH daemon accepts key authentication. Keep the private key on your workstation; never copy it to the VPS or paste it into a ticket, chat, or connection string.
Test the account outside Workbench first. From a terminal, use the same values you plan to enter in Workbench:
ssh -p 22 -i ~/.ssh/id_ed25519 [email protected]Replace the port, key path, username, and host with your values. If this ordinary SSH login fails, Workbench’s tunnel will fail too; fix the SSH account, key, network route, or firewall before changing database settings.
Check SSH forwarding policy
The SSH server must permit TCP forwarding. A hardened configuration can disable forwarding even when interactive logins work. Confirm that forwarding is allowed by the daemon configuration and by any account-specific restrictions. Reload or restart the SSH service only after validating its configuration, and retain an existing session while testing so a configuration mistake does not lock you out.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Keep MySQL private where possible
Inspect MySQL’s bind address and listening port on the VPS. If MySQL and the SSH endpoint are on the same machine, 127.0.0.1 is normally sufficient for the tunnel’s server-side destination. If MySQL is on another private server, use the private address that the VPS can route to, and make sure that network’s firewall permits the VPS to reach the database port.
Prepare and select the SSH key
Workbench recommends an SSH key for this connection method. The private key must be readable by the desktop user running Workbench and must correspond to the public key installed for the SSH account.
OpenSSH versus PuTTY keys
A PuTTY .ppk file is not accepted directly as an OpenSSH private key by Workbench’s SSH configuration. Open the key in PuTTYGen and export or convert it to OpenSSH format, then select the converted file in Workbench. Protect the resulting file with operating-system permissions that prevent other local users from reading it.
Do not put passwords in connection strings
SSH and MySQL passwords should not be embedded in a connection string, shell history, screenshot, or public documentation. Use Workbench’s prompts or protected credential storage. An explicit password in a connection specification can be exposed to other users or diagnostic tools on the system.
Configure MySQL Workbench step by step
In Workbench, create a new connection and choose Standard TCP/IP over SSH as the connection method. Complete the fields as follows.
| Workbench field | What to enter | How to decide |
|---|---|---|
| Connection Method | Standard TCP/IP over SSH | This makes Workbench create and use the SSH port forward. |
| SSH Hostname | VPS DNS name or public IP, optionally with :port |
Use the address and port used by ordinary SSH, such as vps.example.com:22. |
| SSH Username | Your Linux account name | This is the operating-system account, not necessarily the MySQL account. |
| SSH Key File | Path to the OpenSSH private key | Choose the key matching the public key in the account’s authorized_keys. |
| MySQL Hostname | 127.0.0.1, localhost, or a private database address |
Enter the address as seen from the VPS, not from your laptop. |
| MySQL Server Port | 3306 unless customized |
Use the port on which the target MySQL service is listening. |
| Username | MySQL database account | This can be completely different from the SSH username. |
| Password | Password for that MySQL account | Provide it interactively or through protected Workbench storage. |
Example values
Suppose SSH is available at vps.example.com on port 22, the Linux account is deploy, the key is /home/alex/.ssh/vps_ed25519, and MySQL listens locally on port 3306. The relevant entries are:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- SSH Hostname:
vps.example.com:22 - SSH Username:
deploy - SSH Key File:
/home/alex/.ssh/vps_ed25519 - MySQL Hostname:
127.0.0.1 - MySQL Server Port:
3306 - MySQL Username: the database account you created for Workbench
On Windows, use the equivalent Windows path to the converted OpenSSH key. Do not reuse the Linux example path literally.
Verify the host fingerprint on first use
On the first connection, Workbench may ask you to accept the VPS host key fingerprint. Compare it with a fingerprint obtained through a trusted channel or from the server console before accepting it. A fingerprint change can indicate a rebuilt server, a changed SSH host key, a DNS or routing mistake, or an interception attempt.
Recommended Free Tools
Do not bypass a changed-fingerprint warning just to make the connection work. Investigate the VPS identity first, then remove or update the stale known-host entry only after you have verified which key is correct.
Workbench stores known hosts under ~/.ssh/known_hosts on Linux and macOS. On Windows, it uses a Workbench-created known-hosts file under the user profile. The exact location can vary with the Workbench installation and user profile, so use the warning and Workbench files rather than deleting unrelated SSH configuration.
Test the connection and interpret the result
Click Test Connection. A successful test demonstrates both stages: Workbench authenticated to SSH and then authenticated to MySQL through the forwarded path. If Workbench prompts for a MySQL password after accepting the SSH host key, that is expected—the database authentication is separate.
Once connected, save the profile without placing secrets in its name or description. Open a schema browser or run a harmless query to confirm that you reached the intended server and database account, especially when several VPS instances have similar names.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Troubleshoot failures by separating the two authentication layers
Most tunnel errors become straightforward when you test SSH, forwarding, network reachability, and MySQL independently.
1. Ordinary SSH login fails
Use the same hostname, port, username, and key in a terminal. Check DNS resolution, the VPS firewall, the local network’s outbound policy, the username spelling, and the key file permissions. If the key is a .ppk, convert it and retry with the OpenSSH file. Do not troubleshoot MySQL until this login succeeds.
2. SSH login works but Workbench rejects the key
Confirm that Workbench is selecting the same private key you used in the terminal and that the file is in OpenSSH format. A key can be valid for one account but not another. Check that the public half is installed in the target account’s authorized_keys and that the desktop user can read the private file.
3. Workbench cannot create the tunnel
Check whether the SSH daemon permits TCP forwarding and whether a server policy, account restriction, bastion rule, or security control disables it. Verify the SSH port in both Workbench and the firewall. A MySQL firewall rule will not fix a failure that occurs before forwarding is established.
4. The tunnel opens but MySQL is unreachable
Verify that MySQL is running and listening on the exact host and port entered in the MySQL fields. Remember that localhost and 127.0.0.1 refer to the VPS from the forwarded connection’s server-side perspective. If the database is on a separate private host, test routing and firewall access from the VPS to that private address.
5. MySQL reports access denied
This is a database authentication problem, not an SSH problem. Recheck the MySQL username, password, authentication plugin compatibility, and privileges. MySQL accounts can be restricted by the host from which they connect; ensure the account is permitted for the connection origin presented by your server configuration.
6. The fingerprint warning appears again
Stop and verify the VPS identity. A changed key after a legitimate rebuild should be documented and confirmed through a trusted administrative channel. Treat an unexplained change as a security event rather than accepting the new key automatically.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →7. Read the Workbench connection log
When the test still fails, inspect Workbench’s connection log for the stage that failed. Errors commonly point to an incorrect key, disabled TCP forwarding, or firewall rules. Use that evidence to decide whether to return to SSH testing, server forwarding policy, network rules, or MySQL configuration.
Manual SSH forwarding versus Workbench-managed forwarding
Workbench is convenient when one GUI profile should create and close the tunnel automatically. A manual local forward is useful when several clients share one tunnel or when you want the SSH session managed separately.
| Consideration | Workbench-managed tunnel | Manual ssh -L tunnel |
|---|---|---|
| Exposure | Database traffic stays inside SSH; no public MySQL listener is required. | Provides the same encrypted path when configured correctly. |
| Configuration | Fields are stored in one Workbench connection profile. | You create and maintain the forwarding command or SSH configuration. |
| Multiple clients | Best suited to Workbench itself. | One local forward can serve multiple local clients. |
| Operations | Starts and stops with the Workbench connection. | Can be kept persistent through an SSH config, service, or bastion workflow. |
| Authentication | Separate SSH key authentication and MySQL credentials. | Also uses separate SSH and MySQL authentication unless another client supplies credentials. |
A typical manual forward looks like this:
ssh -N -L 13306:127.0.0.1:3306 -p 22 -i ~/.ssh/vps_ed25519 [email protected]In a separate client, connect to local port 13306. The SSH process sends that traffic to 127.0.0.1:3306 as seen on the VPS. Choose a local port that is unused, and stop the forwarding process when it is no longer needed. This approach adds a second set of moving parts, so Workbench’s integrated method is usually simpler for a single desktop connection.
Security hardening after the first successful connection
- Restrict SSH access at the VPS firewall to the networks that need it when practical.
- Use separate named Linux accounts and keys rather than sharing one private key among administrators.
- Keep MySQL off the public interface unless a documented architecture requires public access.
- Grant the MySQL account only the schemas and operations Workbench users actually need.
- Protect private keys with local file permissions and, where supported, a passphrase.
- Review SSH and MySQL logs for unexpected authentication attempts.
- Document the verified host fingerprint and the expected SSH and MySQL ports.
- Rotate keys and database credentials through a planned process, testing replacement access before revoking an old credential.
Do not confuse encryption with authorization. The SSH tunnel protects the path, but the SSH account, MySQL account, firewall, and database privileges still determine who can reach and change data.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11When the VPS and database are on different hosts
The same Workbench method works when the SSH endpoint is a bastion or application VPS and MySQL is on another private host. In that case, the MySQL Hostname must be the private DNS name or IP reachable from the SSH server, not localhost. Confirm that the bastion can route to the database and that the database firewall allows the bastion’s address. The SSH account authenticates to the bastion; the MySQL account authenticates to the database service.
Operational checklist
- Confirm the VPS DNS name or IP and SSH port.
- Confirm a non-root SSH account and matching OpenSSH private key.
- Test ordinary SSH with those exact values.
- Verify SSH TCP forwarding and firewall rules.
- Verify MySQL is running, listening, and reachable from the VPS.
- Record the MySQL host as seen from the VPS and its actual port.
- Create a Workbench profile using Standard TCP/IP over SSH.
- Verify the host fingerprint before accepting it.
- Enter the separate MySQL username and password without exposing them in a connection string.
- Test, inspect the log if needed, and confirm the connected server before making changes.
Frequently Asked Questions
Why are SSH and MySQL usernames different?
SSH authenticates a Linux operating-system account so Workbench can reach the VPS. MySQL then authenticates a database account; the two accounts can have different names, passwords, and privileges.
Should MySQL Hostname be the VPS public IP?
Usually no. Enter the address reachable from the VPS, commonly 127.0.0.1 or localhost when MySQL runs on that VPS. Use the VPS public address only if MySQL is actually listening there and that exposure is intentional.
Can I use a .ppk key in Workbench?
Not directly as the default PuTTY format. Convert it to OpenSSH format with PuTTYGen, then select the converted private key.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
