iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The safest general pattern is to keep MySQL off the public Internet, open an SSH connection to a host that can reach the database, and forward a local port to MySQL through that connection. Run ssh -N -L 127.0.0.1:13306:127.0.0.1:3306 sshuser@ssh.example.com, then point your MySQL client at 127.0.0.1:13306. Your MySQL username and password remain separate from the SSH account.
What an SSH tunnel does
SSH local forwarding creates a listening TCP port on your computer. When a MySQL client connects to that local port, SSH carries the connection through an encrypted session to the SSH server, which then opens a connection to the destination host and port. OpenSSH defines local forwarding as forwarding connections from a local TCP port to a host and port on the remote side; Oracle describes the result as an encrypted SSH tunnel. See the OpenSSH manual and Oracle’s port-forwarding guide.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe important detail is that the destination is viewed from the SSH server’s network, not from your workstation. In -L local_port:destination_host:destination_port, local_port is opened on your computer. The SSH server contacts destination_host:destination_port. Therefore, 127.0.0.1 in the destination position means “the SSH server itself.”
This arrangement is useful when a firewall permits SSH but blocks direct MySQL access. It also lets you leave MySQL listening only on a private interface or loopback address rather than exposing port 3306 publicly. The tunnel encrypts the network leg carried inside SSH; it does not replace MySQL authentication, account privileges, host-key verification, firewall policy, or operating-system security.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Requirements and network checks
- An SSH account that can log in to a reachable SSH server.
- Network reachability from that SSH server to the MySQL destination and port.
- A MySQL account permitted to connect from the source MySQL sees.
- An unused local TCP port on your client, such as
13306. - An OpenSSH client, or MySQL Shell if you want its built-in SSH support.
The database can run on the SSH server itself, commonly at 127.0.0.1:3306, or on a different private host reachable from it. If it is on another machine, the SSH server must be able to resolve and route to that private hostname or address, and intervening firewalls must permit the database connection.
Set up a tunnel with OpenSSH
1. Choose the local and destination addresses
Use a free local port. The example uses 13306 so it does not conflict with a local MySQL service already using 3306. For a database running on the SSH host, the destination is 127.0.0.1:3306. For a database on a private server, replace that destination with the private DNS name or address and its listening port.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Start the forward
- Open a terminal on your client computer.
- Run
ssh -N -L 127.0.0.1:13306:127.0.0.1:3306 sshuser@ssh.example.com. - Complete SSH authentication and verify the host key when prompted, using your organization’s normal host-key verification process.
- Keep this process running. The
-Noption requests no remote shell command; the SSH process exists to carry the forwarding session.
If the command returns to the prompt immediately, inspect its error output. A successful forward normally leaves the SSH process attached to the terminal until you stop it or the connection fails. Add normal OpenSSH diagnostic options when you need more detail, but do not put passwords in commands or shell history.
3. Connect through the local listener
In a second terminal, configure your MySQL command-line client or GUI with:
| Client setting | Value in this example | Why |
|---|---|---|
| Host | 127.0.0.1 |
The listener is on your own computer. |
| Port | 13306 |
This is the local forwarded port, not necessarily MySQL’s remote port. |
| MySQL username | Your normal MySQL account | MySQL authentication is separate from SSH authentication. |
| MySQL password | Enter it when prompted | Avoid embedding it in a URI or command line. |
For example, a command-line client can use the equivalent of host 127.0.0.1 and port 13306 with its usual interactive password prompt. Do not change the MySQL host to ssh.example.com; the GUI must use the local endpoint created by SSH.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
4. Close the tunnel
When finished, stop the SSH process with the terminal’s normal interrupt action. The local listener disappears when the process ends, and subsequent MySQL connections to that local port will fail until you establish the tunnel again. If you need a long-lived connection, manage the SSH process with your operating system’s service or session tools and define an appropriate restart and key-management policy.
Understand every part of the -L command
The syntax is:
ssh -N -L [bind_address:]local_port:destination_host:destination_port ssh_user@ssh_server| Part | Example | Viewpoint and effect |
|---|---|---|
-N |
-N |
Requests no remote command; the session is used for forwarding. |
| Bind address | 127.0.0.1 |
Binds the listener to the client computer’s loopback interface. |
| Local port | 13306 |
Port that the MySQL client opens on the client computer. |
| Destination host | 127.0.0.1 |
Host contacted from the SSH server’s network; here, the SSH server itself. |
| Destination port | 3306 |
Port where MySQL is listening at the destination. |
| SSH login | sshuser@ssh.example.com |
Account and server used to create the encrypted transport. |
Binding explicitly to 127.0.0.1 or localhost limits the listener to local use. The OpenSSH manual notes that an empty bind address or * can make the forwarded port available on all interfaces. That broader binding can let other machines reach the tunnel through your computer, so use it only when you have a deliberate access-control design.
When MySQL is on a separate private host
Suppose the SSH server is a bastion host and MySQL is on db.internal.example at port 3306. The forwarding pattern becomes:
ssh -N -L 127.0.0.1:13306:db.internal.example:3306 sshuser@ssh.example.comYour client still connects to 127.0.0.1:13306. The name db.internal.example is resolved and contacted from the SSH server’s network. A hostname that resolves on your laptop but not on the bastion will not work. Test name resolution, routing, and the destination port from the SSH host, using the tools permitted by your administrator.
MySQL’s account matching also matters. The server may see the connection as originating from the SSH host or another address on the private network, not from your laptop’s public address. The MySQL account must allow that source according to the server’s account and privilege configuration.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Configure MySQL Workbench and other GUI clients
Start the SSH command first and leave it running. In the GUI connection profile, choose the standard TCP connection mode and enter:
- Hostname:
127.0.0.1orlocalhost - Port: the local forwarded port, such as
13306 - Username and password: the MySQL credentials, not the SSH credentials
Do not enter the database’s private hostname, public hostname, or remote port in the GUI’s host and port fields when using a manually created local forward. Those values belong in the SSH command’s destination portion. If your GUI has its own SSH-tunneling feature, either let it create the tunnel or create one manually, but do not configure two competing forwards for the same local port.
MySQL’s Windows procedure follows this same mapping: establish SSH port forwarding, log in with the SSH session, and configure the ODBC application to use localhost as the MySQL host rather than the remote server name. The official steps are documented in MySQL’s Windows SSH procedure.
Use MySQL Shell’s SSH-tunneling support
MySQL Shell can manage an SSH tunnel as part of its connection specification. Its model uses an SSH-server URI for the SSH endpoint and a separate MySQL-server uri for the database target. The MySQL Shell documentation specifically says not to put the MySQL host and port in the base connection parameters when using SSH tunneling; provide the target in uri instead. Read the current syntax and examples in MySQL connection parameters.
This approach can be convenient when all of your work already happens inside MySQL Shell, because the shell owns the connection setup rather than requiring a separate terminal process. A manually created OpenSSH forward is more client-neutral: any MySQL program that can connect to a TCP host and port can use it. Choose based on where you need the tunnel, how you automate it, and which MySQL Shell features you require.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
MySQL Shell warns that explicit passwords in a connection specification are insecure and recommends interactive prompting. Keep passwords out of URIs, scripts, process listings, and shell history. SSH private keys should likewise be protected with appropriate file permissions and, where practical, a passphrase or approved agent.
The MySQL Shell guide summarizes the security model: “An SSH tunnel lets unencrypted traffic pass over an encrypted connection, and enables authorized remote access to servers that are protected from outside connections by a firewall.” See the MySQL Shell 9.6 User Guide for its supported connection and feature details.
Security practices that still apply
SSH protects traffic between the SSH endpoints, but the rest of the system still needs hardening. MySQL’s security guidance states: “Do not transmit plain (unencrypted) data over the Internet. This information is accessible to everyone who has the time and ability to intercept it.” It recommends encrypted protocols such as SSL or SSH and identifies SSH port forwarding as an encrypted and compressed tunnel technique. Consult the MySQL Security Guidelines.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Keep MySQL private: restrict inbound database access with host firewalls and network controls instead of opening port 3306 to the Internet merely to support remote administration.
- Use a dedicated SSH account: give it only the access needed to reach the database host, and disable unnecessary interactive capabilities where your operational policy permits.
- Verify host keys: confirm the SSH server’s identity through a trusted channel before accepting a new or changed key.
- Protect credentials: SSH and MySQL accounts are different; secure both, use least privilege, and avoid passwords in connection strings.
- Bind locally: use
127.0.0.1unless you intentionally need other machines to consume the forward. Binding to all interfaces changes who can attempt MySQL authentication through your computer. - Consider MySQL TLS: SSH encrypts the forwarded network leg, while MySQL TLS can provide an additional database-protocol layer when required by policy or threat model.
- Audit the endpoint: the SSH host, its operating system, key files, and firewall rules are part of the trusted path.
Troubleshoot a failed connection
“Connection refused” on 127.0.0.1:13306
- Confirm that the SSH process is still running; closing its terminal closes the forward.
- Check whether another local program already owns port
13306. Select another unused local port and update the client profile. - Read the SSH error output to determine whether the local listener failed to bind or the SSH session exited.
- Ensure the GUI is using the same local address and port that the command created.
SSH connects, but MySQL reports a connection error
The SSH path may be healthy while the second hop is not. From the SSH host, verify that the destination hostname resolves, the route exists, the firewall permits the destination port, and MySQL is listening on the expected interface. If the database is on another private host, confirm that the SSH server is allowed to reach that host. Also check that the MySQL account permits the connection source as MySQL sees it.
The connection times out
A timeout usually indicates filtering or an unreachable destination rather than a bad local port. Check firewall rules between the SSH server and MySQL, security groups or network ACLs, and DNS resolution from the SSH server. A service bound only to an address different from the forwarding destination will also fail.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Authentication fails
Identify which authentication stage failed. SSH credentials authenticate sshuser to the bastion; MySQL credentials authenticate the database user after the tunnel is established. Verify each independently, and do not assume that a valid SSH login grants any MySQL privilege.
The GUI reaches the wrong server
Inspect the saved connection profile. It should use 127.0.0.1 or localhost and the local forwarded port. A private database hostname or public server hostname in the GUI bypasses the intended local endpoint and can produce a direct, blocked, or unintended connection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Operational limits and feature choices
A manual OpenSSH tunnel works beneath command-line clients, desktop GUIs, application drivers, and other TCP-capable MySQL tools. It is easy to inspect as a separate process and can be started by scripts or an operating-system service. Its reconnect behavior, logging, and lifecycle depend on how you manage that process.
MySQL Shell’s integrated approach keeps SSH and MySQL connection details in one Shell workflow and can be preferable for Shell-centric automation. It is limited to the features MySQL Shell supports over its tunnel. In particular, the MySQL Shell 9.6 User Guide says AdminAPI commands are not supported over SSH-tunneled connections except for deployment, start, stop, kill, and delete operations for sandbox instances. Plan InnoDB Cluster or other AdminAPI work around that limitation rather than assuming every AdminAPI operation will function through the tunnel.
For ordinary queries and administration, the decision is straightforward: use a local OpenSSH forward when you need broad client compatibility, or MySQL Shell’s SSH support when you want Shell to own the connection workflow. In either case, the SSH server must be able to reach the MySQL destination, and the MySQL client must use the local forwarded address.
Quick verification checklist
- Confirm the SSH server is reachable and the SSH account is authorized.
- Confirm the SSH server can resolve and reach the MySQL destination and port.
- Start a forward bound to
127.0.0.1, using a free local port. - Leave the SSH process running while testing.
- Set the MySQL client host to
127.0.0.1orlocalhostand its port to the local forwarded port. - Supply MySQL credentials separately from SSH credentials.
- Stop or manage the tunnel deliberately when the work is complete.
With those mappings correct, MySQL can remain inaccessible from the public Internet while authorized users reach it through the SSH host and the encrypted forwarding session.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
