phpMyAdmin can work while MySQL Workbench fails because they may use completely different network paths. A phpMyAdmin installation on the VPS often reaches MySQL through a local Unix socket or loopback interface. Workbench on your own computer must reach the VPS over TCP/IP, unless you configure its SSH-tunnel connection. Diagnose the failure type first, then verify Workbench’s endpoint, the MySQL listener, firewalls, account Host grants and TLS settings.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The short explanation: local phpMyAdmin is not proof of remote access
When phpMyAdmin is installed on the same VPS as MySQL, the web application and database server are local to one another. The application can connect through a Unix socket file, or through the VPS loopback interface. Neither path requires the database to accept connections from the public internet.
As an Amazon Associate I earn from qualifying purchases.
MySQL’s connection rules make the distinction important: on Unix, a client using the hostname localhost normally attempts a Unix-socket connection. Using 127.0.0.1 forces TCP/IP, but it still means the local machine. A Workbench process running on your laptop is not local to the VPS, so its direct connection must use the VPS’s reachable IP address or DNS name and the MySQL TCP port. The exception is Workbench’s Standard TCP/IP over SSH method, which carries the database session through an SSH connection.
Therefore, “phpMyAdmin works” confirms that some local route and credentials work. It does not confirm that MySQL is listening on a remote interface, that port 3306 is permitted by firewalls, or that the MySQL account allows your computer’s source address.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Identify what kind of failure Workbench reports
The wording of the error tells you which layer to investigate. Do not change MySQL passwords when the client cannot reach the server, and do not open a firewall port when the server is already rejecting an account.
| Workbench symptom | What it proves | Likely checks |
|---|---|---|
| Connection timeout | No usable response arrived before the client gave up. | DNS or routing, provider rules, host firewall, wrong port, or no listener. |
| Connection refused | The destination was reached, but no service accepted the TCP connection (or a firewall actively rejected it). | MySQL service status, bind_address, skip_networking, and the selected port. |
Access denied for user |
MySQL was reached and evaluated an account, then rejected authentication or its Host match. | Username, password, authentication method and the account’s Host column. |
Host ... is not allowed to connect |
MySQL was reached, but no permitted user-and-host combination matched. | Host grants for the Workbench client’s actual source address. |
| TLS or certificate error | Transport and initial protocol negotiation worked, but encryption requirements did not match. | Workbench SSL mode and the server CA, certificate or key requirements. |
Set the Workbench connection fields correctly
Create or edit the connection in MySQL Workbench and verify every field before changing server configuration.
For an intentionally exposed direct TCP connection
- Connection Method: Standard (TCP/IP).
- Hostname: the VPS public IP, private-network address, or DNS name that your computer can resolve and route to. Do not enter
localhostunless MySQL is running on the same computer as Workbench. - Port: the MySQL classic-protocol port configured on the VPS. The documented default is 3306/TCP; use the actual value if the server was changed.
- Username and password: a MySQL account whose Host grant permits the source address from which Workbench connects.
- Default Schema: leave it blank for the first test. Selecting a schema too early can obscure a basic connection problem.
- SSL: choose a mode that agrees with the server policy. Workbench offers No, If available, Require, Require and Verify CA and Require and Verify Identity. Supply CA, certificate and key files when the selected mode requires them.
For an SSH-tunneled connection
Select Standard TCP/IP over SSH. Workbench then asks for an SSH hostname, SSH username, and either an SSH password or private-key file, plus the MySQL host and port as seen from the VPS. Confirm the SSH host key when prompted. The SSH server commonly listens on 22/TCP, while MySQL can remain bound to a local interface. In this arrangement, Workbench connects to the VPS over SSH and sends the database traffic through the tunnel; port 3306 does not need to be publicly reachable.
For the tunnel’s MySQL hostname, use the database address reachable from the VPS, often 127.0.0.1 or a local socket-to-TCP endpoint, together with the configured MySQL port. Do not assume that the hostname field in SSH mode means the same thing as the public destination in direct mode.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Test name resolution and the TCP path from your computer
Before editing MySQL grants, establish whether your computer can find the VPS and reach the selected port. Workbench documentation recommends testing name resolution with ping and the port with telnet. A TCP probe with netcat is a practical alternative when it is installed:
ping VPS_HOST
nc -vz VPS_HOST 3306Replace VPS_HOST with the same IP address or DNS name entered in Workbench. A successful ping is not required for MySQL—many servers block ICMP—but a DNS failure or an unreachable route must be fixed before database troubleshooting. For a non-default port, substitute that port in the probe.
- If the name resolves to the wrong address, correct DNS or use the VPS address temporarily.
- If the probe times out, inspect the VPS provider’s inbound rules, the VPS host firewall, any office or home firewall, and the route between networks.
- If the probe is refused, verify that MySQL is running and listening on that address and port.
- If the probe succeeds but Workbench says “Access denied,” the network path is working; move to credentials and Host grants.
Verify that MySQL is listening for the kind of connection you are making
On the VPS, inspect the active MySQL configuration rather than assuming the package defaults. Locate the server configuration file used by your installation and check port, bind_address and skip_networking.
bind_address controls which interfaces accept TCP
If bind_address=127.0.0.1, MySQL accepts TCP connections only on the VPS loopback interface. A direct connection to the VPS’s public address cannot work in that state, even if port 3306 is open in every firewall. To support direct access, bind to the intended private or public interface, or to an appropriate all-interface setting, and then restart or reload MySQL according to your operating system’s service procedure. Binding more broadly increases exposure, so use the narrowest interface that meets your design.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
skip_networking disables TCP/IP
When skip_networking is enabled, MySQL does not accept TCP/IP connections at all. Local applications using a Unix socket can continue to work, which explains why phpMyAdmin may remain functional. Disable this option only when TCP access is required, then restart MySQL and retest the listener.
Confirm the actual listener and port
Use your operating system’s socket-listing tool to see whether a MySQL process is listening and on which address. For example, on many Linux systems:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo ss -ltnp | grep 3306A listener shown only on 127.0.0.1:3306 is local; a listener on a private or public interface can accept traffic arriving there, subject to firewall rules. If your installation uses another port, search for that value instead. Also verify that the MySQL service is running and review its error log after any configuration change.
Open only the necessary firewall path
There can be several independent filters: a cloud or VPS provider’s security rule, the VPS operating-system firewall, and a firewall on the client network. MySQL identifies firewall blocking as a primary cause of remote connection failures, and its port reference lists 3306/TCP as the default classic protocol port.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
For direct TCP, create an inbound rule for the configured MySQL port only from your administrator workstation’s fixed public IP address or from the relevant private network range. Do not use an unrestricted “anywhere” rule as a permanent fix. If your address changes, update the narrow rule or use a private network or VPN-like administrative path instead. For SSH tunneling, expose the SSH service (commonly 22/TCP) to the administrator’s source address and keep MySQL restricted to localhost or a private interface.
After changing each layer, repeat the TCP probe from the same computer that runs Workbench. Testing from the VPS itself can give a false sense of security because local traffic follows a different path and may bypass the provider’s edge firewall.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check MySQL’s user-and-Host matching
MySQL authenticates a combination of account name and client Host, not just a password. A user that works in phpMyAdmin on the VPS may match a local Host entry such as localhost, while Workbench arrives from your home or office address and needs a different permitted Host value.
From an administrative MySQL session, inspect the relevant accounts and grants using the account-management statements appropriate to your server version. The mysql.user table shows user and Host combinations; SHOW GRANTS shows privileges assigned to a selected account. Check for duplicate usernames with different Host values, because MySQL chooses the most specific applicable match.
A Host value of % is a wildcard that permits connections from any host. It can help prove that a Host mismatch is the cause during a controlled test, but it should not be a permanent internet-facing policy. Replace it with the administrator’s actual source address or a narrow network range, and grant only the privileges needed for the task. If the client is behind NAT, MySQL may see the network’s public egress address rather than the laptop’s private address; use the address shown in the server’s error log when narrowing the grant.
Recommended Free Tools
Make TLS settings agree on both sides
A direct connection can reach MySQL and still fail during encryption negotiation. Workbench’s SSL choices range from no encryption to requiring and verifying the server’s identity. Select Require and Verify CA or Require and Verify Identity only when the corresponding CA and certificate files, names and trust chain are correctly configured.
For remote servers, phpMyAdmin documentation recommends SSL. Encryption by itself does not prove that you reached the intended server: a configuration that encrypts traffic without verifying the server certificate protects confidentiality in transit but does not authenticate server identity. Match Workbench’s mode to the server’s requirement, provide the CA, client certificate or key files where requested, and ensure the certificate name matches the hostname used by Workbench when identity verification is enabled.
Choose direct TCP or an SSH tunnel
| Decision factor | Direct Standard TCP/IP | Standard TCP/IP over SSH |
|---|---|---|
| Transport | Workbench connects straight to the MySQL TCP listener. | Workbench carries MySQL traffic through an SSH session. |
| Network exposure | The MySQL port must be reachable from the client network. | MySQL can stay on a local or private listener; only SSH needs administrative access. |
| Typical ports | Configured MySQL port, 3306/TCP by default. | SSH commonly uses 22/TCP; MySQL’s port is reached inside the VPS. |
| Identity controls | Provider and host firewall restrictions plus MySQL Host grants protect the exposed listener. | SSH account and key or password control entry; MySQL still evaluates its own user and Host. |
| Encryption and verification | Use the Workbench SSL mode and certificates required by the server. | SSH encrypts the tunnel; apply MySQL TLS as required by your policy and verify host keys. |
| Operations | Simple after firewall, listener and grants are correctly configured. | Requires SSH access and key or credential management, but usually reduces public database exposure. |
For an occasional administrator connection, an SSH tunnel is often the safer default because it avoids publishing MySQL to the internet. Direct TCP can be appropriate when applications, a private network or a controlled administrative subnet genuinely require it, provided the source restrictions, grants and TLS policy are maintained.
A complete troubleshooting sequence
- Record the exact Workbench error and classify it as timeout, refusal, authentication/Host rejection or TLS failure.
- Confirm whether you intend direct TCP or SSH. In direct mode, enter the VPS-reachable hostname and actual MySQL port; in SSH mode, enter SSH credentials and the database endpoint as seen from the VPS.
- Leave Default Schema blank and test with a known administrative or least-privilege account intended for remote use.
- Run
pingfor name resolution and a TCP probe such asnc -vz VPS_HOST 3306from the Workbench computer. - On the VPS, verify MySQL service status, the configured port,
bind_address,skip_networkingand the active listening address. - Check provider and host firewalls. Permit only the necessary source address and port; for SSH mode, protect SSH rather than opening MySQL broadly.
- Inspect MySQL’s user-and-Host entries and grants. Correct the account match instead of permanently using a wildcard Host.
- Align Workbench SSL mode with the server. Install the required CA, certificate and key files and verify the hostname when identity checking is enabled.
- Retest after one change at a time, recording which layer changed. This prevents a successful test from hiding a second, unrelated misconfiguration.
Common wrong fixes and safer alternatives
- Using
localhostin Workbench: this points to the computer running Workbench, not automatically to the VPS. Use the VPS address for direct mode or the database endpoint inside the SSH tunnel. - Opening 3306 to every internet address: this removes a useful security boundary. Restrict the source IP, use a private network, or tunnel over SSH.
- Granting
'user'@'%'permanently: the wildcard accepts any source host. Use the narrowest Host value that works and limit privileges. - Changing the password for a timeout: a timeout occurs before MySQL can evaluate the password. Fix routing, firewalls, the listener or the port first.
- Disabling TLS verification to silence a certificate error: this may encrypt traffic without proving server identity. Correct the CA, certificate names and Workbench verification mode instead.
- Assuming phpMyAdmin’s successful login proves remote grants: its local socket or loopback connection may match a different MySQL account Host than Workbench does.
What a working configuration looks like
In a direct design, Workbench uses the VPS DNS name or IP, the configured MySQL port, a MySQL account whose Host grant matches the administrator’s source address, and a firewall rule limited to that source. MySQL listens on the intended interface, TCP networking is enabled, and TLS settings match.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →In an SSH design, MySQL can continue listening only on the VPS’s local interface. Workbench authenticates to SSH on the VPS, confirms the host key, then connects through the tunnel to the local MySQL endpoint. The MySQL account still needs a Host entry matching the connection as MySQL sees it, and any required MySQL TLS policy still applies.
Bottom line
phpMyAdmin works because it is probably local to MySQL; Workbench fails because it is remote and needs a valid TCP path, listener, firewall rule, account Host match and compatible TLS configuration. Use the VPS address—not an unexplained localhost—for direct TCP, or choose Workbench’s SSH method and keep MySQL private. Diagnose each layer in order and never trade a simple connection test for unrestricted database exposure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
