The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use MySQL Workbench’s Standard TCP/IP over SSH connection method. Workbench logs in to the VPS with an SSH account and private key, then carries a separate MySQL connection through that encrypted session. Set SSH Hostname to the VPS address, MySQL Hostname to the database address as seen from the VPS (usually 127.0.0.1), and MySQL Server Port to 3306 unless your server uses another port. The database does not need a public-facing MySQL port.
What the SSH-tunnel connection actually does
An SSH tunnel creates an encrypted path between your computer and the VPS. Workbench first opens SSH to the VPS. Inside that session, it forwards the database traffic to the MySQL service. MySQL then authenticates the database user separately.
That means two identities are involved:
- SSH identity: the Linux account, SSH username and private key that allow access to the VPS.
- MySQL identity: the database username and password (or another MySQL authentication method) accepted by the server.
The word localhost in the MySQL fields refers to the tunnel’s server-side destination. If MySQL and the SSH endpoint are on the same VPS, 127.0.0.1 or localhost means that VPS—not your laptop. The tunnel therefore lets MySQL remain bound to a local or private interface instead of exposing port 3306 to the Internet.
MySQL Workbench describes this option as a method that connects to MySQL Server “using TCP/IP over an SSH connection.” It is generally the safest and simplest choice for one Workbench installation connecting to one VPS.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Prerequisites and a secure baseline
Prepare the server before entering anything in Workbench. You need a reachable SSH service, a working MySQL service, and credentials for both layers.
Create a dedicated SSH login
Use a normal, non-root Linux account for the tunnel. Install your public key in that account’s ~/.ssh/authorized_keys file and confirm that the account can log in interactively. Keep ownership and permissions on the SSH directory and key files correct for your operating system; an SSH client may refuse a key that is readable or owned incorrectly.
Recommended Free Tools
You do not need to create a MySQL user with the same name. The operating-system account and the database account are independent, and separating them makes access easier to audit and revoke.
Keep MySQL private when possible
When MySQL runs on the same VPS as SSH, configure MySQL to listen on a local or private interface. The tunnel connects from the VPS side, so a public listener for port 3306 is unnecessary. If MySQL is on a different private machine, use the address and port that the VPS itself can reach, and restrict that private network path to the required hosts.
Allow forwarding and protect the SSH service
The SSH daemon must permit TCP forwarding. A server policy that disables forwarding will allow an ordinary shell login but still prevent Workbench’s tunnel from opening. The VPS firewall and any upstream firewall must allow SSH from your network on the configured SSH port. Do not open MySQL publicly merely to make Workbench connect.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Have the exact values ready
Collect the VPS DNS name or IP address, SSH port, Linux username, OpenSSH private-key file, MySQL host as seen from the VPS, MySQL port, and MySQL database credentials. A wrong value in one layer can look like a failure in the other, so write them down separately.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhich value goes in each Workbench field?
| Workbench field | What to enter | How to decide |
|---|---|---|
| Connection Method | Standard TCP/IP over SSH | This enables Workbench-managed port forwarding. |
| SSH Hostname | VPS DNS name or IP, optionally including the SSH port, such as vps.example.com:22 |
Use the address you use for a normal SSH login. Replace 22 with your actual SSH port when needed. |
| SSH Username | The Linux account used for SSH | Use the dedicated non-root account, not the MySQL username. |
| SSH Key File | Your OpenSSH private-key path | Select the private half of the key pair. Never select or upload the public .pub file. |
| MySQL Hostname | 127.0.0.1, localhost, or another host reachable from the VPS |
Use the address from the VPS’s perspective. For a local MySQL service, use 127.0.0.1 or localhost. |
| MySQL Server Port | 3306 by convention, or your custom port |
Match the port on which MySQL is listening at the selected MySQL hostname. |
| Username | The MySQL database account | This can be entirely different from the SSH account. |
| Password | The password for that MySQL account | Enter it only in Workbench’s protected credential prompt or storage; do not put it in a connection string. |
If your provider gives you an IPv6 address, enter it in the form Workbench accepts for your version. If the VPS uses a nonstandard SSH port, preserve that port consistently in both your ordinary SSH test and Workbench.
Configure MySQL Workbench step by step
- Open the connection editor. Start Workbench and create a new connection from the home screen. In Connection Method, select Standard TCP/IP over SSH.
- Enter the SSH endpoint. In SSH Hostname, enter the VPS DNS name or IP. Include the SSH port in the form supported by your Workbench version, for example
vps.example.com:22. Enter the Linux account in SSH Username. - Select the key. Browse to the OpenSSH private key in SSH Key File. Workbench recommends key-based SSH. A PuTTY
.ppkfile is not accepted directly as an OpenSSH key; open it in PuTTYGen and export or convert it to OpenSSH format, then select the converted private key. - Enter the database destination. Put
127.0.0.1orlocalhostin MySQL Hostname when MySQL is on the VPS itself. If the database is on another machine accessible from the VPS, enter that machine’s private DNS name or IP instead. Set MySQL Server Port to3306unless the MySQL configuration uses a custom port. - Enter MySQL credentials. Supply the database username and password, which are validated by MySQL after the SSH tunnel is established. Do not assume the Linux username or SSH password is valid for MySQL.
- Save only what is appropriate. Workbench can remember connection details, but avoid embedding a password in a connection specification. MySQL’s connection guidance warns that “Specifying an explicit password in the connection specification is insecure and not recommended.” Use an interactive prompt or the client’s protected credential storage.
- Test the connection. Click the connection test. Workbench should first authenticate to SSH, establish forwarding, and then log in to MySQL. A successful test confirms both layers, not merely that port 22 is reachable.
Verify the VPS independently before blaming Workbench
Testing the layers in order makes failures much easier to identify. First reproduce the SSH login outside Workbench with the same hostname, port, username and key. For an OpenSSH client, the shape is:
ssh -i /path/to/private_key -p 22 sshuser@vps.example.comReplace the path, port, username and hostname with your values. If this command fails, fix DNS, the firewall, the account, the key permissions or the SSH daemon before changing MySQL settings.
Once SSH works, check MySQL from the VPS itself. Use the server’s local MySQL client or another diagnostic that targets exactly the host and port entered in Workbench. Confirm that MySQL is running, listening on that interface and accepting the intended account. A service listening only on a Unix socket, for example, will not accept a TCP connection to 127.0.0.1:3306 until TCP listening is enabled.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
You can also model the tunnel with a manual local forward when diagnosing or when several applications need to share one tunnel:
ssh -N -L 13306:127.0.0.1:3306 -p 22 sshuser@vps.example.comThis command maps local port 13306 to the VPS’s 127.0.0.1:3306. While it remains running, a local client can target 127.0.0.1:13306. Use a free local port, and do not expose that local listener beyond the interfaces you trust. Workbench’s integrated method performs the equivalent forwarding for its connection and avoids maintaining a separate shell process for a single GUI session.
Host-key verification and known hosts
On the first SSH connection, verify the VPS host fingerprint through a trusted administrator or provider channel. This fingerprint proves that the host you are contacting is the expected server rather than an impostor.
Workbench records accepted hosts. On Linux and macOS, SSH known hosts are stored under ~/.ssh/known_hosts. On Windows, Workbench uses a known-hosts file under the user profile. If a previously accepted VPS presents a different fingerprint, Workbench reports a host-key error. Treat that as a security event: confirm whether the server was rebuilt, its address was reassigned or its SSH keys changed, and investigate the identity before removing or replacing the old entry.
Do not “fix” a changed fingerprint by blindly accepting it. A legitimate rebuild and a man-in-the-middle attack can produce the same symptom until you verify the new fingerprint independently.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Troubleshoot a failed SSH tunnel
Use the symptom that best matches the failure and test one layer at a time.
Workbench cannot open the SSH tunnel
- Run the ordinary SSH command with the exact hostname, port, username and key. A mismatch between that command and Workbench is a common cause.
- Confirm that the selected private key is OpenSSH format and readable. Convert a PuTTY
.ppkkey with PuTTYGen; selecting the public key or an unsupported format will fail before MySQL is contacted. - Check the VPS firewall, any cloud firewall and your local network for the configured SSH port.
- Verify that the SSH daemon permits TCP forwarding. A successful shell login does not prove forwarding is enabled.
- Inspect Workbench’s connection log for the specific SSH error rather than relying on the generic connection-failed message.
SSH succeeds but Workbench says MySQL is unreachable
- Recheck MySQL Hostname. With a local database,
localhostmeans the VPS, not your laptop. - Confirm that MySQL is running and listening on the entered TCP port. The conventional port is
3306, but installations can use another port. - From the VPS, test the same host and port. If the service is bound to a private address, use that address rather than assuming loopback.
- For a database on a second private machine, verify routing and firewall rules between the VPS and that machine. The SSH server must be able to reach the destination.
The tunnel opens but MySQL rejects the login
- Check the MySQL username and password independently from the SSH credentials.
- Verify that the MySQL account is permitted to connect from the source host MySQL sees. Host-based privileges can distinguish
localhost, an IP address and a remote hostname. - Check the account’s authentication plugin and required privileges. A valid SSH key does not grant any database rights.
- Use the server’s MySQL error log or an administrator’s diagnostic to distinguish an incorrect password from an authorization or authentication-plugin problem.
The fingerprint changed
Stop and verify the VPS identity out of band. Do not delete the known-hosts entry until you know why the key changed. After confirmation, replace the stale entry using the normal SSH/Workbench known-hosts procedure and reconnect.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Security practices that keep the tunnel useful
- Use keys instead of reusable SSH passwords where your server policy permits, and protect the private key with an operating-system passphrase.
- Use a least-privilege SSH account. The account needs to establish forwarding; it does not need to be root for ordinary Workbench access.
- Restrict inbound SSH. Allow the SSH port only from the networks or addresses that need it, while retaining a tested administrative recovery path.
- Keep MySQL off the public Internet when the tunnel is the intended access path. Restrict database bind addresses and firewall rules to the required private interfaces.
- Protect both credential sets. Do not paste SSH or MySQL passwords into shell history, connection strings, tickets or public documentation.
- Review forwarding policy. If the account is dedicated to tunneling, server-side SSH policy can limit what it may forward while preserving administrative access through another account.
- Rotate deliberately. When a key, VPS or administrator changes, update authorized keys and verify the new host fingerprint rather than silently reusing old trust.
Workbench-managed forwarding versus a manual tunnel
Both approaches use SSH encryption; the operational difference is who owns the forwarding process.
| Consideration | Standard TCP/IP over SSH in Workbench | Manual ssh -L forwarding |
Direct public MySQL access |
|---|---|---|---|
| Exposure | Database traffic stays behind the SSH endpoint; MySQL need not be public. | Can provide the same private database path when the local forward is correctly restricted. | Requires exposing another network service and defending MySQL directly. |
| Setup | One saved GUI connection for a Workbench user. | Requires starting, monitoring and stopping a separate tunnel. | Appears simple to a client but adds public firewall and database configuration. |
| Authentication | SSH key plus separate MySQL credentials. | SSH credentials plus separate MySQL credentials. | Database authentication is exposed to the public network; SSH is not part of the path. |
| Multiple clients | Convenient for one Workbench connection. | Useful when several local tools can share one carefully managed local port. | Each client connects directly, increasing the exposed surface. |
| Operations | Workbench opens and closes forwarding with its connection. | Can be managed with SSH configuration, a service or a bastion workflow for persistent use. | Requires ongoing hardening, monitoring and patching of the public MySQL endpoint. |
For a single developer using Workbench, the integrated method usually has the least moving parts. A manually managed tunnel becomes attractive when scripts, command-line clients and multiple GUI tools must use the same forward, or when an organization already operates persistent SSH tunnels and bastion hosts.
Situations that require different values
MySQL is on another private server
The SSH Hostname remains the VPS that accepts your SSH login. The MySQL Hostname becomes the private address that the VPS can reach, not the address your laptop would use. Ensure the VPS firewall and the database server’s firewall permit that path, and keep the database listener private.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
SSH and MySQL use custom ports
Enter the actual SSH port with the VPS hostname in the form your Workbench version supports, and enter the actual MySQL listener port in MySQL Server Port. Never substitute the SSH port for the MySQL port: they are independent services.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA bastion host is required
If policy requires an intermediate bastion, the SSH endpoint and forwarding design must match your organization’s approved SSH configuration. Workbench’s simple single-hop form may not express every multi-hop arrangement; an administrator-managed SSH configuration or a pre-established local forward can be appropriate. Preserve host-key verification for every hop and avoid opening MySQL publicly as a workaround.
The VPS was rebuilt or its IP was reassigned
Expect a host-key warning. Confirm the new fingerprint and ownership first, then update the known-hosts record. Also verify that the rebuilt machine has the intended SSH account, authorized key, TCP-forwarding policy, MySQL listener and firewall rules.
A repeatable connection checklist
- Confirm the VPS DNS name or IP and the SSH port.
- Confirm a non-root SSH account and its authorized public key.
- Test ordinary SSH with the same key and endpoint.
- Verify that TCP forwarding and the SSH firewall rule are enabled.
- Confirm MySQL is running and listening on the host and port the VPS can reach.
- Open Workbench and choose Standard TCP/IP over SSH.
- Enter the SSH hostname, SSH username and OpenSSH private key.
- Enter the VPS-side MySQL hostname and port, normally
127.0.0.1:3306for a local service. - Enter the separate MySQL username and password.
- Verify the host fingerprint on first connection and investigate any later change.
- Run Workbench’s connection test and use its log to identify whether the failure is SSH, forwarding, network reachability or MySQL authentication.
This arrangement gives Workbench encrypted transport without making the database itself a public service. The decisive details are the perspective of the MySQL hostname, the separation of SSH and MySQL credentials, an OpenSSH-format key, and a server policy that allows forwarding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
