Connect to Redis with redis-cli -h <vps-host> -p <port> PING, then authenticate with an ACL username and password or with the password in REDISCLI_AUTH. The command works only after Redis is listening on the expected interface, the VPS firewall allows your client, and Redis authentication settings match the credentials you provide. For a connection that crosses an untrusted network, add TLS with --tls --cacert <certificate> (plus a client certificate and key when mutual TLS is enabled).
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Redis is intended for trusted clients, not unrestricted internet access. Treat network exposure as part of the connection setup: keep local-only instances on the loopback interface, use a private interface for authorized remote clients, and firewall the Redis port to known sources before testing credentials.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat you need before connecting
Gather these values from the VPS configuration or the person who administers Redis:
- VPS host: the hostname or IP address that the client can reach.
- TCP port: Redis commonly uses
6379, but the configured port is authoritative. A TLS listener may use a different port. - Database number: Redis selects database 0 when no other number is supplied. Include the configured number when the application uses a non-default logical database.
- Credentials: an ACL username and password on Redis 6 or later, or the legacy shared password configured with
requirepass. - TLS material, if required: the server CA certificate and, for mutual TLS, a client certificate and private key.
Do not guess the endpoint from a control-panel label. The address must resolve from the machine running your client, and the port must match the listener Redis actually opened.
#1 Best Overall
Secure the VPS network path first
Keep Redis local when only local applications need it
If the web application, worker, or other client runs on the same VPS, bind Redis to 127.0.0.1. A loopback binding makes the service reachable from that machine without putting the Redis port on the VPS’s external interfaces. Test with a local redis-cli PING before changing the bind policy.
Use a private interface for a separate trusted client
When an application runs on another server, bind Redis to the specific private interface that the application uses, then allow the Redis TCP port only from that client’s private address or network in the VPS firewall and any cloud security group. Do not broaden the rule to every source merely to make an initial test pass.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not make public binding the default
Binding to 0.0.0.0 exposes Redis on every IPv4 interface. Redis security guidance describes the service as intended for trusted clients and specifically recommends firewalling the Redis port on an internet-exposed virtual machine. A public address plus a password is not an adequate substitute for a restricted network path: scanners can still reach the authentication service and exploit configuration mistakes or software vulnerabilities.
Understand protected mode
Protected mode is a safety response to potentially unsafe exposure. If Redis receives a non-loopback request while its safety conditions are not satisfied, it can reject the request with a protected-mode error instead of accepting remote traffic. Disabling protected mode blindly removes that safeguard; it does not fix a missing firewall rule, an unsafe bind address, or a wrong listener. Correct the network and authentication configuration first.
Configure authentication
ACLs on Redis 6 and later
Redis recommends access-control lists (ACLs) for named users and fine-grained command and key permissions. Create or use a user intended for the application rather than sharing an unrestricted administrator credential. The client must send both the ACL username and its password.
With redis-cli, supply the ACL username through the client’s user option and keep the password in REDISCLI_AUTH:
Rank #2
REDISCLI_AUTH='<password>' redis-cli --user <username> -h <vps-host> -p <port> PINGThe exact permission set belongs in the Redis ACL configuration. A successful network connection with an account that lacks permission can still fail later when the application issues a command or accesses a key pattern it was not granted.
The legacy requirepass method
requirepass protects the server with one shared password. It remains a valid legacy authentication method, but it does not provide the per-user and per-permission controls available with ACLs. Use a long, unique secret and plan an ACL-based migration when your Redis version and application support it.
Keep secrets out of command history
Putting a password directly in a command-line option can expose it through shell history or process inspection. Redis documents REDISCLI_AUTH as an alternative to the -a option. Set the variable only for the command or session that needs it, protect any service configuration that stores it, and avoid pasting credentials into shared terminals or issue trackers.
Verify Redis locally on the VPS
Testing from the server separates a Redis service problem from a firewall or routing problem. Log in to the VPS through its normal administrative channel and run:
redis-cli PINGA PONG proves that the local client reached a listening Redis instance and completed an unauthenticated ping. If authentication is enabled, provide the configured credentials while running the same test. For a legacy password, for example:
REDISCLI_AUTH='<password>' redis-cli PINGFor an ACL user:
REDISCLI_AUTH='<password>' redis-cli --user <username> PINGIf the local test fails, do not troubleshoot the remote client yet. Confirm that the Redis service is running, that the configured port is the one you are testing, and that the bind setting includes the local interface. A local refusal means there is no listener at that address and port; a local authentication error means Redis is reachable but the supplied identity is not accepted.
Connect from an authorized remote client over TCP
Basic password connection
After the local test succeeds and the firewall permits the remote source, run this from the authorized client:
REDISCLI_AUTH='<password>' redis-cli -h <vps-host> -p <port> PINGReplace the host and port with the values collected from the VPS. A PONG confirms the complete path: name resolution or routing, firewall policy, Redis listener, and password authentication.
ACL username and password
For an ACL account, include the username as well as the password:
REDISCLI_AUTH='<password>' redis-cli --user <username> -h <vps-host> -p <port> PINGIf your client library uses a connection URL instead of separate options, the equivalent form is:
redis://<username>:<password>@<host>:<port>/<db-number>URL-encode reserved characters in the username or password before placing them in a URI. Characters such as @, :, /, ?, and # have structural meaning in a URL; leaving them raw can make a correct secret look like a wrong host, port, or credential.
Select a non-default logical database
Redis starts with database 0 unless the client selects another number. With redis-cli, use the client’s database option when available, or include the database number in a URL. Ensure the application and your diagnostic command use the same number; a successful PING does not prove that you are looking at the database where the application’s keys reside.
Rank #4
Use TLS when the network is not fully trusted
Plain TCP protects neither the password nor Redis commands while they cross the network. Use the TLS listener whenever traffic leaves a trusted private segment or when your security policy requires encryption in transit.
Server-authenticated TLS
Point redis-cli at the TLS port, enable TLS, and provide the CA certificate that signed the Redis server certificate:
redis-cli -h <host> -p <tls-port> --tls --cacert <redis_cert>.pem PINGAdd the password or ACL username in the same way as for a plain connection:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesREDISCLI_AUTH='<password>' redis-cli --user <username> -h <host> -p <tls-port> --tls --cacert <redis_cert>.pem PINGThe CA file lets the client validate the server certificate. Use the hostname that the certificate covers; connecting by an unrelated address can cause certificate validation to fail even when the Redis service is healthy.
Mutual TLS
When the server requires client certificates, add both the client certificate and its private key:
redis-cli -h <host> -p <tls-port> --tls --cacert <redis_cert>.pem --cert <client.crt> --key <client.key> PINGKeep the private key readable only by the account that runs the client. Mutual TLS authenticates the client at the transport layer; Redis ACL credentials may still be required for command and key permissions.
Prevent accidental plaintext use
If every connection must be encrypted, configure a TLS port and set the non-TLS Redis port to 0. That removes the plaintext listener rather than relying on each application to remember a TLS setting. Update every client to use the TLS port before making this change, and retain a local administrative path for recovery.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Redis uses the rediss:// URL scheme to identify a TLS connection. The URI still needs the correct host, port, database number, credentials, and certificate-validation settings in the client library.
Diagnose failures in a safe order
Start with the lowest layer that could be broken and move upward. The error text usually tells you whether the client reached Redis at all.
| Symptom | What it indicates | Next check |
|---|---|---|
| Connection timed out | Packets are being dropped before Redis answers. | Check the VPS firewall, cloud security group, routing, source allow-list, bind address, and whether the client is using the configured port. |
| Connection refused | The destination was reachable, but no service accepted the connection on that address and port. | Verify that Redis is running, listening on the requested interface, and configured for that port. |
| Protected mode error | Redis rejected non-loopback access under its safety defaults. | Restrict the firewall and bind to the intended interface, then configure authentication. Do not disable protected mode as a shortcut. |
NOAUTH or an ACL permission error |
The client reached Redis, but credentials are missing, incorrect, expired, or insufficient for the requested command/key. | Check the username, password, URL encoding, selected database, and ACL permissions. Test with the same identity locally. |
| TLS handshake or protocol error | The client and server disagree about TLS mode, port, trust chain, or client-certificate requirements. | Use the TLS port with --tls, supply the correct CA, add the client certificate and key when required, and ensure you are not sending plaintext to a TLS listener or TLS to a plaintext listener. |
Run redis-cli PING locally, then the plain remote command, then the TLS command if applicable. This sequence prevents a certificate problem from being confused with a firewall problem and prevents an ACL problem from being mistaken for a routing failure.
Self-hosted Redis on a VPS versus managed Redis
A VPS gives you direct control over Redis configuration, interfaces, firewall rules, upgrades, and data handling. That control also makes you responsible for operating the security boundary. A managed Redis service can reduce the amount of server administration, but its network controls, TLS requirements, backup policy, pricing, and portability depend on the provider and plan. Compare the responsibilities before changing deployment models.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Decision area | Redis on your VPS | Managed Redis service |
|---|---|---|
| Network exposure | You choose the bind interface and firewall allow-list. | The provider supplies an endpoint and network controls; confirm how private access and source restrictions work. |
| Firewall and TLS | You configure the Redis listener, firewall, certificates, and TLS-only policy. | Review which TLS modes, certificates, ports, and firewall integrations the service supports. |
| Credentials and ACLs | You create users, passwords, and command/key permissions in Redis. | Verify whether the service exposes native ACLs, provider identities, or both. |
| Backups and updates | You schedule backups, test restoration, apply Redis updates, and maintain the host. | Check the included backup retention, restore process, maintenance windows, and upgrade policy. |
| Operational cost | You pay for the VPS and supply the time and expertise to operate Redis securely. | You pay the service fee in exchange for less infrastructure administration; pricing and limits vary. |
| Latency and placement | You select the VPS location and can place Redis beside your application. | Latency depends on the provider’s regions, networking, and the plan you select. |
| Portability | Standard Redis access remains under your control, subject to your own configuration. | Evaluate provider-specific features, export options, and migration effort before committing. |
Managed hosting is worth considering when you do not want to operate Redis security and networking yourself. It does not remove the need to understand endpoint access, credentials, TLS, and least-privilege permissions; your application still has to connect with the service’s documented settings.
A repeatable connection runbook
- Record the VPS hostname or IP, configured Redis port, database number, authentication model, and TLS requirements.
- Choose the narrowest network design: loopback for same-host applications, a private interface for a separate trusted client, and a firewall rule limited to that source.
- Confirm the Redis listener and authentication configuration on the VPS. Keep the Redis port closed to untrusted sources.
- Run a local authenticated
redis-cli PING. Continue only after receivingPONG. - From the authorized client, run the plain TCP command with
REDISCLI_AUTHand the ACL username when applicable. - If the path is untrusted or the endpoint is TLS-only, switch to the TLS port, add
--tls --cacert, and provide client certificate options for mutual TLS. - Use the same database number and permissions as the application, then test an application-level operation that its ACL is authorized to perform.
- Record the final host, port, database, TLS mode, and credential-delivery method in the application’s protected configuration so future changes do not require opening Redis more broadly.
The practical success criterion is an authenticated PONG from the intended client over the intended network path. If that check fails, fix the layer named by the error before changing Redis’s safety defaults.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
