Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTo connect HeidiSQL to a remote MySQL server, choose either a direct TCP/IP session or an SSH tunnel. For a direct session, put the database server’s reachable DNS name or IP address in Hostname / IP and usually use port 3306. For an SSH tunnel, put 127.0.0.1 in HeidiSQL’s database settings, then put the real SSH server and forwarding details in the SSH tunnel tab. The login will work only when the network path, MySQL listener, firewall, and MySQL account’s allowed host all agree.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the connection method first
HeidiSQL is a graphical client for MySQL and MariaDB. A remote connection can be made in two fundamentally different ways:
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Direct TCP/IP: HeidiSQL connects straight to the MySQL listener over the network. The database hostname or IP goes in the normal session settings.
- SSH tunnel: HeidiSQL creates an encrypted SSH port forward and then connects to a local endpoint. The database can remain inaccessible from the public internet.
Use direct TCP/IP when the client and database are on a private network, VPN, or a tightly restricted firewall path. Use an SSH tunnel when the server accepts SSH but MySQL should stay private. An SSH tunnel protects the transport between the HeidiSQL computer and the SSH server; it does not replace MySQL authentication or authorization.
| Setting or concern | Direct TCP/IP | SSH tunnel |
|---|---|---|
| Database Hostname / IP in HeidiSQL | Remote DNS name or IP address | Usually 127.0.0.1 |
| Network exposure | MySQL port is reachable over the selected network path | MySQL can remain private behind SSH |
| Credentials | MySQL username and password | MySQL credentials plus SSH credentials or a private key |
| Typical ports | MySQL commonly uses 3306 |
SSH commonly uses 22, plus an unused local forwarding port such as 3307 |
| Best fit | Private network, VPN, or controlled firewall rule | Host reachable by SSH while MySQL is not publicly reachable |
Gather the prerequisites
Before opening HeidiSQL, collect the values for the connection type you plan to use.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
For a direct connection
- The remote server’s DNS name or IP address.
- The MySQL username and password.
- The MySQL TCP port. The classic MySQL protocol normally uses
3306, but a server may be configured differently. - The network path to that port, including any VPN, private routing, firewall, or cloud security-group rule.
For an SSH tunnel
- The SSH hostname or IP address and SSH port, normally
22. - The operating-system username used for SSH.
- An SSH password or a private-key file accepted by the server.
- The MySQL account credentials.
- An unused local port, for example
3307, for the forwarding endpoint. - The database destination as seen from the SSH server. It may be
127.0.0.1:3306on that server or an internal database hostname and port.
HeidiSQL’s installer includes plink.exe. Newer Windows installations can also use Microsoft’s ssh.exe. Keep private keys protected and do not place passwords in command-line arguments or shared session files.
Option A: create a direct TCP/IP session
A direct session is appropriate only when the MySQL listener is reachable from the computer running HeidiSQL and the server administrator intends to allow that path.
- Open HeidiSQL’s session manager and click New.
- Choose MySQL (TCP/IP), or the equivalent MariaDB/MySQL TCP/IP network type.
- In Hostname / IP, enter the remote server’s reachable DNS name or IP address. Do not enter
127.0.0.1unless MySQL is running on the same computer as HeidiSQL. On a remote session,127.0.0.1means the HeidiSQL computer itself. - Enter the MySQL username and password.
- Enter the server’s MySQL TCP port. Use
3306when the server uses the usual classic-protocol default; replace it with the configured port when it does not. - Open the session.
If the session opens, HeidiSQL has reached a listening MySQL service and authenticated an account permitted from the connecting host. If it fails, test the layers below in order rather than repeatedly changing the password.
Confirm that MySQL is listening on a reachable address
The server’s bind_address setting controls the network addresses on which mysqld listens. A listener bound only to loopback accepts local connections but cannot accept a direct connection from another machine. The listener must be bound to an address reachable through the intended private interface or network.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Do not change bind_address to a wildcard solely to make a test pass. A wildcard can expose MySQL on every available interface. If a broader bind is genuinely required, pair it with a narrowly scoped firewall or security-group rule and a private network, VPN, or SSH design.
Confirm firewall and routing rules
The client must be able to route to the server address, and every intervening firewall or cloud security group must allow the selected MySQL port from the client’s source network. A successful DNS lookup does not prove that the port is reachable. Conversely, an open port does not prove that MySQL will accept the account.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Option B: connect through an SSH tunnel
An SSH tunnel is often preferable when the database should not be exposed directly. HeidiSQL makes two endpoints visible: the local database endpoint used by HeidiSQL and the SSH endpoint used to create the forward.
Configure the database side in HeidiSQL
- Open the session manager and click New.
- Select MariaDB/MySQL (SSH tunnel) as the network type.
- On the main Settings tab, set Hostname / IP to
127.0.0.1. This is the local end of the tunnel, not the public address of the server. - Enter the MySQL port. In a normal setup this is the remote MySQL port, commonly
3306; use the local forwarded port displayed or required by your HeidiSQL tunnel configuration when it differs. - Enter the database username and password. These are MySQL credentials, not the SSH login.
Configure the SSH tunnel tab
- Choose
plink.exeor Microsoft’sssh.exeas the SSH executable. - In SSH Host, enter the server name or IP address that accepts SSH. This is the SSH endpoint, which may be different from the database’s internal address.
- Set SSH Port to the server’s SSH port, normally
22. - Enter the operating-system account used for SSH.
- Select SSH-password authentication or the private-key file accepted by the server.
- Choose an unused Local port, such as
3307, if HeidiSQL asks you to specify one. The local port must not already be occupied by another process. - Set the forwarded destination to the database address and port as seen from the SSH server. If MySQL runs on that same SSH host, this is commonly
127.0.0.1:3306. If the SSH host is a jump host, use the database’s internal hostname and MySQL port when the tunnel field provides a separate remote-host destination. - Save the session and open it.
HeidiSQL first establishes SSH, listens on the selected local port, and forwards traffic to the configured database destination. It then connects its database driver to the local endpoint. Therefore, the database-side Hostname / IP remains 127.0.0.1 even when the actual MySQL server is on another machine.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Understand jump-host layouts
Suppose the public machine gateway.example accepts SSH, while the database is reachable from that machine only as mysql.internal:3306. Put gateway.example in SSH Host and mysql.internal with port 3306 in the tunnel’s remote destination. Do not put the database’s public address in HeidiSQL’s database Settings tab; that bypasses the local forward and can cause the tunnel to target the wrong endpoint.
Set up the MySQL account correctly
MySQL authenticates a combination of username and client host. An account written as 'appuser'@'localhost' is a different account from 'appuser'@'203.0.113.25' or an account for a subnet. A correct password is not sufficient when the connecting host does not match an account row.
Recommended Free Tools
Match the account to the actual connection path
For direct TCP/IP, MySQL evaluates the host from which HeidiSQL connects, such as the client’s private IP address or a permitted subnet. For an SSH forward that terminates on the database host, MySQL commonly sees the forwarded connection as coming from the SSH host or its local loopback interface. Verify the host shown in an error message and check the server’s account rows rather than guessing.
A temporary wildcard such as 'appuser'@'%' can help diagnose an unknown client address, but it permits that username to connect from any host. If it is used for testing, replace it with the actual host or narrowly defined subnet immediately afterward.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Grant only the required privileges
Use a dedicated account instead of root. Give it only the database privileges the application or administrator needs, such as read-only access when writes are unnecessary. After creating or altering an account, use SHOW GRANTS to inspect the effective privileges for the User/Host entry MySQL actually selected.
The privilege system associates an authenticated account with rights such as SELECT, INSERT, UPDATE, and DELETE. This means a successful network connection can still produce a permission error when the account lacks access to a particular schema or operation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Secure the transport and exposure
Why SSH helps
An SSH tunnel encrypts traffic between the HeidiSQL computer and the SSH server while allowing the MySQL port to remain closed to the public internet. Restrict SSH itself with ordinary server hardening, source-network rules, strong authentication, and secure private-key handling. The tunnel does not grant database privileges; MySQL still checks the database username, password, and host match.
When direct TCP/IP is necessary
If a direct connection is required, restrict the firewall to known source networks and use TLS. MySQL supports account-level TLS requirements through CREATE USER ... REQUIRE, and clients can be configured to require encrypted connections. Where your deployment supports certificate verification, verify the server certificate rather than merely enabling encryption.
Protect credentials and session data
- Use a dedicated least-privilege database account.
- Avoid using
rootfor routine remote work. - Store private keys with permissions that prevent other users from reading them.
- Do not put passwords in command-line arguments, scripts, or shared HeidiSQL session files.
- Keep MySQL private whenever an SSH tunnel, VPN, or private network can provide the required access.
Troubleshoot by the exact symptom
“Can’t connect to MySQL server” or a timeout
- Check that the hostname resolves to the intended server and that the selected port is correct.
- For a direct session, confirm that
mysqldlistens on an address reachable from the HeidiSQL computer and that firewall or security-group rules allow the source network. - For a tunnel, first confirm that the SSH login succeeds, then confirm that the local forwarding port is unused and that the remote destination is correct from the SSH host’s point of view.
- Only after the network path works, investigate MySQL account matching and privileges.
“Lost connection to MySQL server at ‘reading initial communication packet’”
HeidiSQL identifies this as a common tunneling mistake: the SSH tunnel is pointed at the remote server’s public IP incorrectly. Put 127.0.0.1 in Settings > Hostname/IP, and put the remote machine that accepts SSH in SSH tunnel > Host. If the database is behind a jump host, set the internal database destination in the tunnel’s remote-host field instead of replacing the local database endpoint.
“Access denied for user …”
The password may be wrong, but the selected User/Host account may also be different from the one you expected. The error text identifies the attempted username and client host. Inspect the matching account row, then run SHOW GRANTS for that account to verify its effective rights. Check whether you are using direct TCP/IP or a tunnel, because the apparent client host can differ between those paths.
“Host … is not allowed to connect”
No MySQL account row matches the supplied username and the host from which the connection arrived. Create or alter a narrowly scoped account for the real client host or subnet, test again, and remove any temporary wildcard grant. Do not solve this by granting every host permanently.
The SSH tunnel opens, but MySQL still fails
An SSH login proves only that the SSH endpoint accepted your operating-system credentials. It does not prove that the forwarded destination is listening or that the MySQL account is valid. Distinguish the SSH endpoint from the database endpoint: SSH Host is the machine accepting SSH, while the forwarded destination may be 127.0.0.1:3306 on that machine or an internal database host and port. HeidiSQL’s database connection should target the local forwarded endpoint.
A repeatable verification checklist
- Identify whether the session is direct TCP/IP or SSH tunnel.
- For direct TCP/IP, use the remote DNS name or IP in Hostname / IP; for a tunnel, use
127.0.0.1there. - Verify the MySQL port, normally
3306, and the SSH port, normally22when tunneling. - Confirm that the listener address, route, firewall, and security-group rules support the chosen path.
- Confirm that the SSH executable, SSH host, SSH username, authentication method, and local forwarding port are correct.
- Confirm the tunnel’s remote database destination from the SSH server’s perspective.
- Use a dedicated MySQL account whose User/Host entry matches the actual connection source.
- Inspect privileges with
SHOW GRANTSand remove temporary wildcard access. - Use SSH or TLS, restrict source networks, and protect keys and passwords.
Which setup should you use?
Choose direct TCP/IP when the database is intentionally available on a private network or VPN and a firewall can restrict access to known clients. Choose an SSH tunnel when the server is reachable by SSH but the MySQL listener should stay private, especially across an untrusted network. In either case, the reliable setup is the one that keeps the database listener reachable only where necessary and aligns HeidiSQL’s endpoint fields with the actual network path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
