To connect to MySQL on another VPS privately, make sure the two servers have a working private route, configure mysqld to listen on the database VPS private address, authorize the client VPS private IP in MySQL, and allow TCP port 3306 only from that source in both firewall layers. Connect with the database private IP and explicit TCP mode. If direct database ingress is undesirable, forward a local port through an SSH bastion instead.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the connection looks like
Assume the database VPS has private address 10.0.2.10 and the application or client VPS has private address 10.0.2.20. The client opens a TCP connection to 10.0.2.10:3306. The provider’s private network carries that traffic without sending it over the public internet.
As an Amazon Associate I earn from qualifying purchases.
A private address is not automatically reachable. Both VPS instances must be attached to the same provider private network, or to networks with routes between them. Provider security groups, network ACLs, and each server’s local firewall must also permit the connection. MySQL then applies a second layer of authorization: the account’s 'user'@'host' definition must match the source address that MySQL sees.
Oracle’s MySQL 8.4 Reference Manual describes the basic model this way: “The MySQL server listens on one or more network sockets for TCP/IP connections.” The bind_address setting determines which local interfaces accept regular client TCP connections.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose direct private TCP or an SSH tunnel
| Characteristic | Direct private-IP TCP | SSH local forward |
|---|---|---|
| Exposure | MySQL listens for the client network on its private interface; port 3306 remains closed to the public interface. | MySQL can remain inaccessible to the client network and is reached through an SSH bastion that can access the database VPS. |
| Network requirement | A functioning private route plus provider and host firewall rules. | SSH reachability to the bastion and a route from the bastion to the database private address. |
| Operational complexity | Configure the listener, account, and two firewall layers once; maintain the rules as addresses change. | Maintain an SSH process, key access, local port choice, and tunnel restart behavior. |
| Performance | Uses the direct private path between the VPS instances. | Adds one forwarding hop and SSH encryption overhead. |
| Failure diagnosis | Check private routing, security group, host firewall, listener, and MySQL authorization. | Check SSH authentication, bastion routing, local forward state, then MySQL authorization. |
Use direct private TCP when the private network is trusted and you want a simple, continuously available application connection. Use a tunnel when the database should not accept direct connections from the client network or when an approved bastion is already part of the architecture.
Prerequisites and an address plan
Before changing MySQL, record the addresses and ownership of each layer:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Database VPS private address, such as
10.0.2.10. - Client VPS private address, such as
10.0.2.20. - The provider private-network or VLAN attachment for both servers.
- The provider firewall or security-group rule set attached to the database VPS.
- The database server’s local firewall policy.
- The MySQL option-file location and the service name used by the operating system.
Use the actual interface addresses assigned by your provider; the example addresses are documentation values, not addresses to copy blindly. If the provider assigns a new private address after a rebuild, update the MySQL account host rule and firewall rules together.
Step 1: Confirm private-network reachability
Verify interfaces and routes
On each VPS, inspect the addresses and route table:
ip addrip routeConfirm that the database’s private address is assigned to an interface and that the client has a route whose destination covers that address. A missing interface, route, or provider attachment must be fixed in the VPS control plane before MySQL configuration can help.
Test the path from the client
From the client VPS, test the private address. ICMP may be blocked even when TCP is allowed, so treat a failed ping as inconclusive:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ping -c 3 10.0.2.10Once a listener exists, test the actual port:
nc -vz 10.0.2.10 3306If the port test times out, investigate routing and firewall policy first. Do not open port 3306 publicly as a diagnostic shortcut.
Step 2: Bind MySQL to the private interface
Set bind_address
On the database VPS, edit the MySQL server option file and add or change the [mysqld] section:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
[mysqld]
bind_address = 10.0.2.10The exact option-file path differs by distribution and installation. Change the value to the database VPS private address, not the client’s address. MySQL supports documented multi-address configurations where appropriate; follow the syntax for the MySQL version installed rather than guessing a delimiter or format.
Binding to the private address prevents the normal TCP listener from accepting connections through unrelated interfaces. If the server must also serve a deliberately approved second network, configure only the documented addresses required for that design. Avoid a wildcard listener when the purpose is to keep the database off public interfaces.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRestart and verify the listener
Restart the service using the service name supplied by your operating system, commonly mysql or mysqld:
sudo systemctl restart mysqlIf that unit does not exist, use the distribution’s MySQL service unit. Check its status and inspect recent logs if the restart fails. Then verify which local addresses have a listener:
sudo ss -ltnp | grep 3306The output should show port 3306 bound to 10.0.2.10 (or the configured private address). A listener on 127.0.0.1:3306 accepts only local connections, while a listener on a public address would defeat the intended isolation and needs correction.
Step 3: Create a least-privilege MySQL account
Match the client host explicitly
Log in locally on the database VPS with an administrative MySQL account and create a user whose host component is the client VPS private address:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteCREATE USER 'app'@'10.0.2.20' IDENTIFIED BY 'use-a-long-random-secret';
GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'app'@'10.0.2.20';In MySQL, 'app'@'10.0.2.20' is different from 'app'@'localhost'. The host portion participates in account matching, so a password that works locally does not prove that a remote account exists. The remote-connection example in the MySQL documentation likewise ties the account host to the connecting address.
Grant only what the application needs
Replace the sample privileges with the smallest set required by the workload. A read-only reporting process may need only SELECT; a migration or administration account should not be reused by the application. Keep administrative accounts local when possible.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
If several client VPS instances genuinely need access, use the narrowest private subnet that contains only those clients and understand the resulting trust boundary. Do not use a broad wildcard host merely to avoid diagnosing an address mismatch. If a client address changes, create or alter the intended account and remove the obsolete host entry.
Inspect the effective grants
After creation, verify the account definition and grants while logged in as an administrator:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →SHOW GRANTS FOR 'app'@'10.0.2.20';Store the password in the application’s secret-management mechanism rather than in shell history, a shared script, or a publicly readable configuration file.
Step 4: Restrict both firewall layers
Provider firewall or security group
Create an inbound rule on the database VPS that permits TCP destination port 3306 only when the source is the client VPS private IP, 10.0.2.20, or the smallest private subnet required by the application. Keep the rule on the private-network policy and do not add a public source range.
Host firewall
Apply the same restriction in the database VPS operating system firewall. The rule should allow TCP 3306 from the client private address and leave other sources denied. If an existing default-deny policy is in place, add the narrow allow rule without weakening unrelated services.
Provider and host firewalls are independent. A provider rule cannot override a host firewall drop, and a permissive host firewall cannot override a provider security-group denial. Record both rules so that future address or network changes can be made consistently.
Step 5: Connect explicitly over TCP
From the client VPS, use the database private address and force TCP:
mysql --protocol=TCP -h 10.0.2.10 -P 3306 -u app -p appdbEnter the password when prompted. MySQL documents TCP/IP as the transport for remote servers. On Unix-like systems, using localhost can select a Unix socket instead of TCP, so use the private IP or explicitly specify --protocol=TCP. A successful login confirms that the route, firewall path, listener, account host, password, and database name are all usable for this connection.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Application connection settings
Configure the application with the same private hostname or address, port 3306, database name, and restricted account. If you use a private DNS name, confirm that it resolves to the private address from the client VPS and that it cannot unexpectedly resolve to a public address. Keep connection timeouts and retry behavior appropriate for your application; repeated retries do not fix a blocked route or denied account.
Recommended Free Tools
Step 6: Validate in a controlled order
- On the database VPS, confirm the private interface and route with
ip addrandip route. - Confirm that
mysqldis listening on the intended private address withss -ltnp | grep 3306. - From the client VPS, test TCP reachability to
10.0.2.10:3306. - Check the provider security-group rule and the database host-firewall rule for the exact client source address.
- Attempt the MySQL command with
--protocol=TCP. - If authentication fails, inspect the account host component, password, selected database, and effective grants.
- If the server or client enforces TLS, verify that the connection options satisfy that policy instead of weakening it.
Troubleshoot by symptom
| Symptom | Most likely layer | Checks and corrective action |
|---|---|---|
| Connection times out | Private route or firewall | Confirm both private interfaces and routes, then inspect provider and host rules. Ensure the source is the client’s private IP, not its public NAT address. |
| Connection refused | No usable listener or wrong bind address | Run ss -ltnp | grep 3306 on the database VPS. Check that MySQL restarted successfully and is listening on the private address and port. |
| Access denied for user | MySQL authorization | Check that the account host matches the source address MySQL receives, verify the password, and inspect SHOW GRANTS. |
| Local login works but remote login fails | Socket versus TCP or host-specific account | Use the private IP with --protocol=TCP; localhost may use a Unix socket, and 'app'@'localhost' is not the remote account. |
| Client reaches the port but TLS negotiation fails | Security policy mismatch | Review the server’s TLS requirements and the client connection options. Keep the required encryption and certificate validation policy intact. |
| Connection works from one VPS but not another | Source-specific rule or account | Compare the second client’s private address with provider firewall rules, host firewall rules, and its MySQL 'user'@'host' entry. |
Change one layer at a time and retest. This prevents a permissive firewall change from hiding an incorrect MySQL account definition and makes the eventual configuration easier to audit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security practices for a private MySQL link
- Keep port 3306 off every public interface for this use case.
- Allow only the client private IP or a tightly bounded private subnet.
- Use a dedicated application account and least-privilege database grants.
- Use a long, unique secret and rotate it through your normal secret-management process.
- Review provider and host firewall logs when diagnosing unexpected sources.
- Monitor for private-address changes after rebuilds, scaling events, or network migrations.
- Apply the server’s required TLS policy when credentials or data need encryption in transit beyond the guarantees of the private network.
- Keep administrative MySQL access separate from the application account.
A private network reduces public exposure; it does not make every host on that network trustworthy. The firewall source restriction and MySQL host-specific account are complementary controls, not substitutes for one another.
SSH tunnel fallback
An SSH local forward is useful when the database should not accept direct connections from the client network. The bastion must be able to reach the database VPS private address, and the client must be able to authenticate to the bastion over SSH.
Start the local forward
Run this on the client VPS:
ssh -N -L 13306:10.0.2.10:3306 [email protected]The -L option binds local port 13306 and forwards it through the SSH session to 10.0.2.10:3306 as seen from the bastion. Keep this process running; closing it removes the forwarding path. Choose a local port that is not already in use.
Connect through the forwarded port
In a second client-shell session, connect to the local endpoint with TCP:
mysql --protocol=TCP -h 127.0.0.1 -P 13306 -u app -p appdbThe MySQL account still needs to authorize the source address that the database server sees. Depending on the tunnel topology, that may be the bastion’s private address rather than the original client’s address. Create the account and firewall rule for the actual database-side source, and do not assume that the local 127.0.0.1 address is what MySQL uses for authorization.
Operate the tunnel reliably
For a long-running application, supervise the SSH process with the operating system’s service manager or another approved process supervisor. Use key-based authentication with restricted permissions, define keepalive and restart behavior according to your operations policy, and alert when the tunnel exits. If the tunnel fails, first test SSH authentication and bastion reachability, then test the bastion-to-database route, and only afterward investigate MySQL credentials.
MySQL’s security guidance states: “Alternatively, use SSH to get an encrypted TCP/IP connection between a MySQL server and a MySQL client.” The tunnel encrypts traffic between the SSH endpoints; it does not remove the need for correct MySQL authorization or prudent bastion access controls.
Handling address and topology changes
When the database private IP changes
Update the MySQL bind_address, provider firewall destination, host firewall rules, application configuration, and any SSH forward target that references the old address. Restart or reload MySQL as required and verify the listener before reopening application traffic.
When the client private IP changes
Update the inbound provider and host firewall source rules and the MySQL account host. Remove the old source entry after the replacement has been tested. If you intentionally use a private subnet for a pool of clients, document why that range is trusted and keep it as narrow as the deployment permits.
When adding another client VPS
Decide whether the new server should receive its own account and firewall rule or whether it belongs to an already approved subnet. Separate accounts provide clearer revocation and auditing; a subnet rule reduces configuration churn but enlarges the set of hosts that can attempt a connection.
Final verification checklist
- The two VPS instances share a working private route.
mysqldlistens on the database private address, not only on a Unix socket or public interface.- TCP 3306 is allowed from the client private source in both provider and host firewalls.
- The MySQL account host matches the address the database server sees.
- The account has only the required database privileges.
- The client uses the private address and explicit TCP mode.
- TLS requirements, if enforced, are met by the client.
- If using SSH, the bastion route, local forward, process supervision, and database-side source address are all documented.
Frequently Asked Questions
Why does MySQL show an access-denied error when the firewall test succeeds?
A successful TCP test proves only that a socket is reachable. MySQL still selects an account by its user and host components, so an entry such as 'app'@'localhost' will not authorize a client connecting from a VPS private address.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Can I use a private DNS name instead of the numeric private IP?
Yes, provided it resolves from the client VPS to the database’s private address consistently. Verify the resolved address and continue to force TCP so the client does not substitute a local Unix socket.
Does an SSH tunnel make the MySQL port public?
No. The local forward exposes a chosen port on the client side and carries it through SSH to the bastion’s database route. Keep the database firewall restricted to the bastion-side source and protect SSH access itself.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
