Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →To enable remote MySQL access safely, configure four separate controls: make MySQL listen on the VPS address that should receive connections, create a MySQL account allowed from the client host, permit TCP 3306 through both the VPS and provider firewalls, and encrypt the connection with TLS or an SSH tunnel. If only one administrator or a small trusted team needs access, an SSH tunnel usually lets you keep port 3306 closed to the Internet. Direct access is appropriate for applications or larger client populations when source addresses, certificates and firewall rules can be managed reliably.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
How remote MySQL access works
A failed connection can be caused by any link in the chain, and changing only one setting rarely solves the problem. A remote client must be able to reach the VPS address and port; the MySQL server must be listening on that address; the operating-system and provider firewalls must pass the packet; and MySQL authentication must accept the client host. The session should then be protected with TLS or carried inside an SSH tunnel.
As an Amazon Associate I earn from qualifying purchases.
MySQL authorization is host-aware. An account is identified by both a user name and a host pattern, so 'appuser'@'localhost' and 'appuser'@'203.0.113.25' are different accounts with potentially different passwords and privileges. MySQL describes this access-control-list model as applying to connections, queries and other operations users can attempt.
Choose the connection design before changing the server
Direct connection with MySQL TLS
A client connects to the VPS address on TCP 3306. This design suits application servers, monitoring systems or many users that must connect without an interactive SSH session. You must maintain a narrowly scoped firewall rule, stable source addresses or a controlled private network, and MySQL TLS certificates and client settings. If the source address changes, the firewall and the MySQL host-qualified account may both need updates.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
SSH local forwarding
An SSH tunnel leaves MySQL reachable only on the VPS loopback interface or private network. The client opens an SSH connection, and SSH forwards a local port to the VPS’s MySQL port. No public database port is required. This is generally simpler for occasional administration and small trusted teams, but every user needs an SSH account or key, and the tunnel must remain open while the database client is in use.
| Decision point | Direct MySQL over TLS | SSH local tunnel |
|---|---|---|
| Public exposure | TCP 3306 is reachable only from explicitly allowed addresses, ideally through a private network. | No public MySQL port is needed; expose SSH instead. |
| Typical client population | Applications or many automated clients. | One administrator or a small number of trusted users. |
| Encryption administration | Configure MySQL TLS, certificates and client verification; require_secure_transport can enforce encrypted TCP connections. |
SSH supplies the encrypted transport; MySQL can remain private on the VPS. |
| Source-address management | Firewall and MySQL host matching depend on a known client address or network. | The VPS sees the SSH connection; the database client connects through the local forward. |
| Audit and operations | Database and network logs show direct database sessions; certificate renewal and firewall maintenance are required. | SSH authentication and logging are central; users must start and maintain the forward. |
Do not choose direct access merely because it is convenient. Oracle’s MySQL security guidance says not to transmit unencrypted data over the Internet and recommends SSL or SSH over untrusted networks. Bitnami likewise warns that making application network ports public is a significant security risk.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCollect the addresses and access requirements
Write down the values you will use before editing configuration:
- VPS listener address: the specific IPv4 or IPv6 address on which MySQL should accept connections. A private address is preferable when the client and VPS share a private network.
- Client source address: the public address, private address or CIDR range from which the client will connect. Avoid a broad Internet-wide range.
- Database port: normally TCP 3306 unless the installation deliberately uses another port.
- Transport: direct MySQL TLS or an SSH tunnel.
- Privileges: the exact databases and operations the client needs.
If the client has a changing residential address, a direct firewall rule tied to that address will eventually stop working. Use a controlled private network, a stable egress address, or an SSH tunnel instead of opening 3306 to everyone.
Configure MySQL to listen on the required interface
Find the Linux option file
On Ubuntu installations, a common server configuration file is /etc/mysql/mysql.conf.d/mysqld.cnf. Other distributions, packages and VPS images can use a different included option file. Confirm which file is read by the installed MySQL service before editing it, and make a backup so the previous working configuration can be restored.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Set a specific bind address
Under the [mysqld] section, set bind-address to the VPS interface that should receive database traffic:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match[mysqld]
bind-address = 192.0.2.24Replace the example with the VPS address you recorded. If IPv6 is required, use the appropriate IPv6 address and ensure that the operating system, provider firewall and client all support it. Binding to a specific address limits which interfaces accept TCP connections. A wildcard address accepts connections on all interfaces and increases exposure, so use it only when every interface is intentionally protected.
Do not confuse listening with authorization. A listener on the right address does not grant any user access; the MySQL account and firewall still have to permit the connection.
Restart the service carefully
Restart MySQL using the service unit supplied by the distribution or VPS image. The unit name is not universal, so confirm it with your package documentation or service manager rather than blindly applying a command from another image. After restarting, check the service status and logs for syntax errors, an invalid address or a port conflict. A typo in the option file can prevent the server from starting.
Create a dedicated account for the remote host
Use a host-qualified identity
Log in locally or through an existing administrative path and create an account tied to the expected client address. For example:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
CREATE USER 'appuser'@'203.0.113.25'
IDENTIFIED BY 'use-a-long-unique-secret';The address in this example is documentation-only. Substitute the client’s actual source address, or use a narrowly defined network pattern when several known clients must connect. MySQL’s IPv6 documentation similarly demonstrates creating an account for a specific host.
Grant only the required privileges
Grant access to the application database and only the operations the client needs. An application that reads and writes its own schema generally should not receive server-wide administrative privileges. Avoid using a broadly permitted root account for remote work. Do not use a wildcard host such as 'appuser'@'%' unless you have a compelling, documented reason and compensate with very strict network controls; it allows authentication attempts from any source that can reach the port.
Review existing accounts before creating another one. A local account with the same user name is not automatically the account used by a remote connection, because host matching is part of authentication. Keep the password unique to this database account and store it in the application’s secret-management system rather than in shell history or source code.
Restrict both firewall layers
VPS operating-system firewall
Permit inbound TCP 3306 only from the recorded client address or private CIDR. For a UFW-managed host, a rule can be expressed as:
sudo ufw allow from 203.0.113.25 to any port 3306 proto tcpUse your distribution’s equivalent firewall mechanism if UFW is not installed. Do not create an unrestricted rule such as allowing TCP 3306 from every source. Keep SSH access restricted separately so a database rule does not accidentally alter your management access.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Cloud-provider firewall or security group
Many VPS platforms filter traffic before it reaches the operating system. Add a TCP 3306 rule there as well, with the same narrow source address or private-network scope. A permissive provider rule can expose a port even when the local firewall is configured correctly; a restrictive provider rule can make a valid local rule appear broken. Check both layers whenever the client cannot connect.
MySQL’s security guidance recommends a firewall and says port 3306 should not be accessible from untrusted hosts. If a private network or SSH forwarding meets the requirement, omit the public 3306 rule entirely.
Protect the transport
Direct connections: configure MySQL TLS
For direct TCP access, configure the server with a certificate and private key, configure clients to verify the server certificate where practical, and require encrypted transport. The exact certificate-file options depend on the MySQL version and distribution. MySQL’s secure-deployment guidance documents the relevant TLS settings; follow the options for your installed release rather than copying paths from a different package.
The require_secure_transport setting can make MySQL reject non-TLS TCP connections. Test existing clients before enabling it, because an old client or an incomplete certificate configuration may be disconnected immediately. A successful login is not proof that encryption is active; inspect the client connection status and server settings to verify that the session negotiated TLS.
SSH connections: keep MySQL private
For an administrator using a local MySQL client, create a local forward:
ssh -N -L 13306:127.0.0.1:3306 [email protected]Keep that SSH process running. The first address and port, 127.0.0.1:13306, are on your computer. The destination, 127.0.0.1:3306, is reached from the VPS. Then point the database client at the local endpoint:
mysql -h 127.0.0.1 -P 13306 -u appuser -pWith this arrangement, MySQL can bind only to loopback on the VPS if no other application needs network access. The public firewall does not need an inbound 3306 rule; SSH must remain available and secured with strong authentication. Do not expose the local forwarded port to other machines unless that sharing is intentional.
Connect and verify each layer
- Check the listener: confirm that the MySQL service is running after the restart and that it is listening on the intended address and port, not only on an unexpected interface.
- Check network reachability: from the external client, test TCP reachability to the VPS address and port. A timeout usually indicates a provider or operating-system firewall, routing problem or wrong address; an immediate refusal usually means no process is listening there or the service rejected the connection.
- Connect with the correct endpoint: use
mysql -h <server-address> -P 3306 -u appuser -pfor direct access, or the loopback and forwarded port for SSH. - Confirm the authenticated identity: after login, inspect the client’s connection status and run
SELECT CURRENT_USER();. This helps confirm that the intended host-qualified account, rather than a different local or wildcard account, matched. - Inspect logs: review the MySQL error log and firewall logs for access-denied messages, TLS failures, rejected hosts, malformed configuration or blocked packets.
- Test the real workload: verify the specific database, schema operations and connection settings used by the application, not just an interactive login.
Troubleshoot by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| Connection times out | Provider firewall, VPS firewall, routing or an incorrect destination address. | Confirm the client source address, both firewall layers, the VPS route and that the client is using IPv4 or IPv6 as intended. |
| Connection is refused | MySQL is stopped, listening on another address or port, or a local rule is actively rejecting traffic. | Check service status, logs, the effective bind-address and the listening port. |
| “Access denied” after the server is reachable | The user password is wrong, the host-qualified account does not match the client’s source address, or privileges are insufficient. | Inspect the account’s host component, recreate or alter the dedicated account if necessary, and grant only the required database privileges. |
| Works locally but not remotely | MySQL is bound to loopback, or only local firewall rules were changed. | Verify the listener address and provider firewall; if remote access is not actually required, use an SSH tunnel instead. |
| Direct TLS connection fails | Certificate paths, trust settings, hostname verification or client TLS support are incompatible. | Review the installed MySQL version’s TLS options, certificate permissions and client error, then test encryption before enforcing secure transport. |
| SSH tunnel connects but MySQL does not | The forward targets the wrong VPS address or port, MySQL is not listening on the target interface, or the local port is already occupied. | Confirm the -L destination from the VPS perspective, choose an unused local port and connect to the local endpoint shown in the command. |
IPv6 and private-network considerations
IPv6 changes both the address syntax and the firewall rule. Create a MySQL account whose host component matches the IPv6 client address or approved network, bind to the intended IPv6 interface, and permit TCP 3306 in both firewalls for that address family. Do not assume that an IPv4 rule protects IPv6; a server may be reachable over IPv6 even when its IPv4 port is closed.
A private network is preferable to a public address when your VPS provider offers one and the client can use it. Bind MySQL to the private interface, restrict the provider and host firewalls to that network, and avoid publishing 3306 on the public interface. Private addressing reduces exposure but does not replace authentication or encryption; treat the network as untrusted unless its security properties are established.
Remove exposure you no longer need
After confirming the required workflow, delete temporary broad firewall rules, remove test accounts and narrow any source range that was wider than necessary. If users now connect through SSH or a private network, remove the public TCP 3306 rule and bind MySQL only to the interface used by that path. Recheck the provider firewall after the change, then test that an unintended external host can no longer reach the database.
Keep a record of the listener address, account host pattern, granted privileges, firewall source and transport choice. Revisit it when a client address, certificate, VPS image or MySQL version changes. A remote-access configuration is safe only while all four controls—listener, account, firewall and encrypted transport—remain aligned.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
