Recommended Free Tools
To connect Navicat to a remote MySQL server, you need four matching details in Navicat’s General tab—host name or IP address, listening TCP port, username, and password—and two server-side conditions: the network must allow the connection and the MySQL account must permit your client’s source IP. MySQL normally listens on port 3306, but the administrator or hosting company may use another port.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
If the database port is blocked from the internet, leave the database service private and enable Navicat’s SSH tunnel instead. The SSH server becomes the reachable entry point, while Navicat connects to the database host from that server. The procedure below covers direct TCP, SSH tunneling, SSL/TLS, least-privilege permissions, and the failure messages that commonly stop a Navicat remote connection.
As an Amazon Associate I earn from qualifying purchases.
Understand the two gates before you configure Navicat
A successful remote connection passes two independent checks. First, your computer must reach the database service at the correct host and TCP port. DNS, routing, firewalls, cloud security groups, and the MySQL listener all affect this transport step. Second, MySQL must accept the account from your source host and authorize that account for the requested database. A server can be reachable and still return an access-denied error because the username, password, host pattern, or database privileges do not match.
Navicat’s help documentation describes the same order: MySQL checks whether the connecting host is allowed and then checks the account’s privileges. Keep transport errors (timeouts, refused connections, and name-resolution failures) separate from authentication errors such as MySQL error 1045.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Collect the connection details first
Ask the database administrator or hosting company for the exact values below. Do not substitute a familiar hostname or assume that 3306 is correct.
- Database host: a DNS name or IP address that is valid from your network, or from the SSH server when tunneling.
- TCP port: the port on which the MySQL or MariaDB service actually listens. MySQL’s default is 3306, but a non-default port is common on managed systems and hardened servers.
- Database username and password: credentials created for remote use, not necessarily the local administrative account.
- Database name: the schema you need to open, if the administrator has restricted your account to one or more schemas.
- Allowed source address: your current public IP address or an approved range. A changing residential or office IP may require an updated MySQL host rule and firewall rule.
- Firewall and security-group status: confirmation that the selected port is allowed from your client network, or that an SSH entry point is available.
- Tunnel or encryption details: for SSH, the server host, SSH port, username, and password or private key; for TLS, the server’s certificate and CA requirements.
For Navicat 17, the official manual documents the MySQL connection fields and General-tab workflow: Navicat 17 manual (PDF).
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Method 1: Create a direct TCP connection
Use direct TCP only when the database port is intentionally reachable from your network and the server policy permits it.
Enter the connection in Navicat
- Open Navicat and choose the command to create a new connection, then select MySQL (or MariaDB when that is the server type you were given).
- In the General tab, enter a friendly Connection Name. This label is local to Navicat and does not change the server account.
- Enter the administrator-supplied database host name or IP address in the host field. Use the exact DNS name when certificate validation or server-side name-based rules depend on it.
- Enter the server’s actual TCP port. Use 3306 only when the administrator confirms the default listener is in use.
- Enter the database username and password. If Navicat offers a database or schema field, enter the schema you were authorized to use; otherwise select it after connecting.
- Save the connection and use Navicat’s test or connect action. A successful test should open the server session and show only the schemas and objects your account can access.
These fields are the client half of the setup. Saving a connection profile does not open a firewall port or grant MySQL privileges; those changes must be made on the server.
Make the MySQL account match your source host
MySQL accounts include both a user name and a host pattern. The same user name can have different passwords and privileges for different hosts. Create or alter an account whose host component matches your public IP address or an administrator-approved range, then grant only the operations the application or analyst needs.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
A narrowly scoped example for a fixed client address is:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCREATE USER 'nav_reader'@'203.0.113.44' IDENTIFIED BY 'Use-a-long-random-secret';
GRANT SELECT ON appdb.* TO 'nav_reader'@'203.0.113.44';Replace the example address, account name, password, and schema with your real values. If the account already exists, use an appropriate ALTER USER statement or have the administrator update its host entry rather than creating a duplicate account. For a user who must edit data, add only the required privileges, such as INSERT, UPDATE, or DELETE, on the specific schema or tables.
Navicat’s privilege guide shows the broader syntax GRANT ALL PRIVILEGES ON *.* TO 'YourUserName'@'YourPublicIP' IDENTIFIED BY 'YourPassword';. Treat that example as documentation of the account-and-host syntax, not as a production recommendation: granting every privilege on every database gives the account far more authority than a normal Navicat user needs. The guide is available at Navicat’s remote privilege-system instructions.
Open only the required network path
The database service must listen on an address reachable through the server’s network interface, and the host firewall, cloud security group, or upstream firewall must allow the selected TCP port from your approved source address. A service bound only to localhost cannot accept a direct connection from Navicat on another machine. Conversely, opening a port while the MySQL service listens on a different port produces a refusal or timeout.
Verify the path from the same network where Navicat runs. DNS tools such as nslookup can confirm that the hostname resolves to the intended server. A TCP probe such as nc -vz db.example.net 3306 can distinguish a reachable listener from a blocked route when your operating system provides netcat. These probes do not authenticate to MySQL; they only test name resolution and transport.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Method 2: Connect through an SSH tunnel
SSH tunneling is the practical fallback when a hosting company or firewall permits SSH but blocks outside connections to the MySQL port. Navicat’s help center describes its major benefit as connecting to MySQL from behind a firewall when the MySQL server port is blocked. See the hosting-focused procedure at Navicat’s SSH-tunnel instructions.
Configure the tunnel
- Create a MySQL connection in Navicat and enter the database credentials in the General section as usual.
- Enable Use SSH tunnel in the connection’s SSH settings.
- Enter the SSH server host name or IP address. This is the machine that accepts your SSH login, which may be the web server, a bastion host, or another approved jump host.
- Enter the SSH port. Port 22 is common, but use the port supplied by the administrator.
- Enter the SSH username and select password authentication or private-key authentication according to the server policy. If a private key is protected by a passphrase, provide it when Navicat requests it.
- Set the database host in the General tab to a name or address that the SSH server can reach. If MySQL runs on that same SSH server,
127.0.0.1orlocalhostis usually the correct database host. If MySQL is on a private network, use its internal DNS name or private IP, not an address visible only from your laptop. - Save and test the connection. Navicat first establishes SSH, then forwards the database connection through that session.
The database port does not have to be publicly reachable for this design. The SSH server must be reachable, must be allowed to connect onward to the database host and port, and must have an account that can create forwarding sessions. If the hosting company disables forwarding or restricts outbound connections, ask for its approved tunnel method rather than repeatedly changing MySQL grants.
Choose the correct host when tunneling
A common mistake is entering the public address of the SSH server as the database host when MySQL is bound to its private interface. Navicat resolves and opens the database leg from the SSH server, so the General-tab host must make sense from that server’s network namespace. Test the database host and port from the SSH machine, or ask its administrator which internal address to use.
SSL/TLS and HTTP tunnel options
Navicat for MySQL lists SSH, HTTP Tunnel, and SSL/TLS as separate secure connection methods in its feature matrix: Navicat for MySQL feature matrix. They solve different problems.
| Method | Database port publicly reachable? | Server-side requirements | Client authentication | When it fits |
|---|---|---|---|---|
| Direct TCP | Yes, the selected MySQL port must be reachable from the client network. | MySQL listener, firewall or security-group rule, and account host permission. | MySQL username and password; TLS can be added when required. | Controlled networks where exposing the database listener is acceptable. |
| SSH tunnel | No; the database port can remain private. | Reachable SSH server, forwarding permission, and onward access from SSH server to the database. | SSH password or private key, plus MySQL credentials. | Hosting or firewall environments that block direct MySQL access. |
| HTTP Tunnel | Depends on the HTTP tunnel endpoint; the database listener can be hidden behind that endpoint. | An HTTP-tunnel service or server component supported by your deployment and policy. | Credentials required by the tunnel and by MySQL, according to the server configuration. | Environments that permit approved HTTP-based database transport. |
| SSL/TLS | It does not change reachability; the underlying direct or tunneled path must still work. | Server TLS configuration and the CA or certificate policy required by the administrator. | MySQL credentials plus certificate validation or client-certificate settings when required. | Protecting traffic in transit and enforcing the server’s certificate policy. |
SSL/TLS encrypts and authenticates the database protocol but does not open a blocked port. You may use TLS over a direct connection or combine it with an SSH tunnel when the server requires both encryption layers. Do not disable certificate verification simply to make a test pass; obtain the correct CA certificate or server policy from the administrator.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Troubleshoot a Navicat connection that fails
Navicat’s troubleshooting guidance notes that unsuccessful connections can have several causes. Work from the network layer upward, changing one variable at a time.
1. The hostname does not resolve or resolves to the wrong server
Confirm the spelling supplied by the administrator and run a DNS lookup from the client network. If the result is an old address, a split-DNS record, or a private address that your network cannot route, correct the hostname or connect through the approved VPN or SSH host. When tunneling, perform the lookup from the SSH server’s network instead.
2. The connection times out
A timeout usually means that packets are being dropped or routed to the wrong place. Recheck the port, firewall rule, cloud security group, and any corporate egress policy. Confirm that the database is listening on the address and port you entered and that the rule allows your current public IP. A timeout does not prove that the password is wrong because MySQL has not yet received a login.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches3. The server refuses the connection immediately
Connection refused commonly indicates that no service is listening on that port, the service is bound only to localhost, or a firewall is actively rejecting the attempt. Verify the MySQL listener and configured port on the server. Do not keep changing account privileges until a basic TCP test reaches the listener.
4. Navicat reports access denied or error 1045
An access-denied response means the network path reached MySQL, but authentication or account matching failed. Check the username and password, then inspect the account’s host component. An account created as 'user'@'localhost' will not automatically accept a login from your public IP. Confirm that the administrator allowed the exact source address or range and that the account has privileges on the requested schema. If your ISP or office changed its public IP, update both the firewall allow-list and the MySQL host rule.
5. You can log in but cannot see or edit the required schema
This is an authorization problem rather than a transport problem. Ask for the account’s grants and compare them with the operation you need. A read-only account may connect successfully but be unable to create tables or update rows. Grant the smallest additional privilege on the required database or table instead of switching to an all-databases administrator grant.
6. Direct access is blocked by the hosting company
Ask whether external MySQL access is disabled and whether SSH tunneling is supported. If SSH is available, obtain the SSH host, port, username, and authentication method, then configure the tunnel and use the database address reachable from the SSH server. Opening random public ports or changing the MySQL account host to a wildcard does not bypass a provider’s network policy.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →7. TLS or certificate validation fails
Confirm that the server requires SSL/TLS, that Navicat is using the correct mode, and that the supplied CA or certificate matches the server name. Certificate errors can occur when you connect by IP address while the certificate was issued to a DNS name. Correct the host name or certificate configuration rather than disabling validation. If the server does not support the selected TLS options, use the method documented by its administrator.
Secure the finished connection
- Restrict the MySQL account to the exact database and operations required. Avoid
GRANT ALL PRIVILEGES ON *.*for routine Navicat work. - Limit firewall rules and MySQL host patterns to known public IP addresses or tightly controlled ranges. Review them when an ISP, office, or VPN address changes.
- Prefer an SSH tunnel when the database does not need to be internet-facing. Keep the database listener private and expose only the SSH entry point that is monitored and patched.
- Use long, unique credentials and store them in Navicat’s protected credential mechanism or an approved password manager. Rotate them when staff, keys, or server access change.
- Enable SSL/TLS when required by the server policy or when traffic crosses an untrusted network, and validate the server certificate or CA.
- Keep Navicat, the SSH service, and the MySQL server updated according to your organization’s maintenance policy.
- Record which account, source address, tunnel host, and schema each connection profile uses so an administrator can audit or revoke it later.
Final verification checklist
- The General tab contains the administrator-supplied host, actual listening port, username, and password.
- DNS resolves the intended host from the network that will initiate each connection.
- A firewall or security group permits the path, or an SSH tunnel is enabled and the SSH server can reach the database host and port.
- The MySQL account’s host pattern matches the current client source address or the connection’s server-side source address.
- The account has the required privileges on the intended schema and no unnecessary global privileges.
- TLS, SSH, or HTTP Tunnel settings match the server’s documented policy.
- A test connection succeeds, and Navicat shows only the databases and actions that the account is supposed to access.
Once those checks align, Navicat can maintain a normal remote MySQL session without exposing more of the database service than your network and security policy allow.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
