iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The safest default is to connect pgAdmin through an SSH tunnel and keep PostgreSQL private on the VPS. A direct connection is also possible, but it requires PostgreSQL to listen on a reachable interface, the VPS and provider firewalls to pass the database port, and pg_hba.conf to authorize your client address. PostgreSQL does not listen for TCP/IP connections in a new, out-of-the-box installation, so entering the server IP in pgAdmin alone will not work.
This guide shows how to prepare either design, register the server in pgAdmin, add TLS when required, and identify the cause of timeouts, refused connections, authentication failures, and host-based access errors.
Recommended Free Tools
What you need before opening pgAdmin
Collect these details from the VPS administrator or hosting panel first. Do not guess the database port or database name; PostgreSQL may have been installed with non-default values.
| Information | What to verify |
|---|---|
| VPS hostname or IP address | Use a DNS name or address that your computer can resolve and reach. For an SSH tunnel, this is normally the SSH host. |
| PostgreSQL port | Use the configured port. Port 5432 is common, but confirm the actual value. |
| Database name | Choose the database you want pgAdmin to use initially. pgAdmin labels this field as the maintenance database or database name. |
| Login role | Use a PostgreSQL role that is permitted to connect to that database. |
| Password or other authentication method | Confirm the role password and the authentication method selected in pg_hba.conf. A valid password cannot overcome a rule that disallows the client. |
| Network design | Decide whether the database port will be reachable directly or whether all traffic will pass through SSH. |
| TLS material, if required | Obtain the required SSL mode, root CA, client certificate, and client key from the server administrator. |
Choose direct TCP or an SSH tunnel
Use direct TCP only when you have a clear reason to expose PostgreSQL to a client network and can restrict access tightly. An SSH tunnel is usually preferable for administration because the database endpoint can remain private and only the SSH service needs to be reachable.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
| Consideration | Direct TCP | SSH-tunneled access |
|---|---|---|
| Database exposure | The PostgreSQL listener is reachable from the allowed network, potentially through a public address. | PostgreSQL can stay on a private interface; pgAdmin reaches it through the SSH transport. |
| Firewall work | The provider firewall, VPS firewall, and PostgreSQL listener must all permit the connection path. | The SSH port must be reachable. The database port does not need to be publicly exposed. |
| PostgreSQL authorization | pg_hba.conf must allow the actual pgAdmin client address. |
pg_hba.conf must allow the address seen by PostgreSQL at the SSH server’s bind endpoint, which may be local to the VPS rather than your workstation. |
| Operational simplicity | Once configured, pgAdmin connects without a separate SSH session, but more network controls must remain aligned. | pgAdmin manages the tunnel in its Server registration; the SSH server, account, and key or password must remain usable. |
| TLS | Use TLS when the server requires it or when your security policy calls for encrypted database traffic. | SSH protects the transport, but TLS can still be required independently by PostgreSQL and must be configured in pgAdmin. |
Prepare PostgreSQL for a direct connection
A direct connection succeeds only when three layers agree: PostgreSQL must listen on the right interface and port, network controls must pass that traffic, and host-based authentication must authorize the client.
1. Confirm the PostgreSQL service and port
Verify that PostgreSQL is running on the VPS and identify the configured port. The standard port is commonly 5432, but a custom port is possible. Check the installed PostgreSQL version and the VPS provider’s network settings before applying any version-specific instructions.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match2. Set an appropriate listener
In the active PostgreSQL configuration, inspect listen_addresses. A new installation commonly does not listen on TCP/IP at all. Configure it to listen on the specific VPS interface that should receive the connection; avoid exposing every interface unless that is an intentional, controlled design. Also confirm that the listener uses the port you entered in pgAdmin.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
After changing the listener, apply the change using the service-management procedure for your Linux distribution. The exact configuration path and restart or reload command vary by distribution and provider, so use the paths reported by the installed PostgreSQL package rather than copying a command intended for another system.
3. Align provider and VPS firewalls
Permit the PostgreSQL port only from the client network or fixed CIDR range that needs access. A provider-level firewall rule and an operating-system firewall rule are separate controls: passing one does not override the other. If either blocks the traffic, pgAdmin may time out even when PostgreSQL is configured correctly.
Do not open the database port to the entire internet merely to test a connection. If your client address changes frequently, an SSH tunnel or a controlled VPN-style network is safer than a permanently broad database rule.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
4. Add a narrow pg_hba.conf rule
Host-based authentication determines which combinations of client address, database, role, and authentication method PostgreSQL accepts. Limit the rule to the required database, role, and client CIDR. Broad rules that allow every database, every role, or unauthenticated access create unnecessary exposure.
For a direct connection, the client address in the rule is the address PostgreSQL actually sees from your workstation or intervening network device. For a tunneled connection, it is normally the SSH server’s bind-side address instead; see the tunnel section below. Reload or restart PostgreSQL according to your distribution after editing the file, and verify that the selected authentication method matches the credentials you plan to enter in pgAdmin.
Register a direct server in pgAdmin
- Open pgAdmin and choose the option to register or create a new server.
- On the General tab, enter a descriptive name such as the VPS role and environment. This name is only pgAdmin’s label and does not have to match the PostgreSQL host name.
- Open the Connection tab. Enter the VPS hostname or IP address in Host name/address, the verified PostgreSQL port in Port, the initial database in Maintenance database, and the PostgreSQL role in Username.
- Enter the role password if password authentication is configured. pgAdmin can save the password in the server registration; only enable that option on a computer whose local account and storage are appropriately protected.
- If the server requires TLS, choose the required SSL mode and provide the certificate fields described in the SSL section.
- Save the registration or use pgAdmin’s connection test. A successful connection is reported with a green status bar. If it fails, use the exact error text rather than repeatedly changing unrelated fields.
The host, port, maintenance database, username, and password fields identify the PostgreSQL connection itself. They do not open a firewall, change listen_addresses, or add a pg_hba.conf permission; those tasks must be completed on the VPS and in its network controls.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Set up pgAdmin’s SSH tunnel
Use this design when PostgreSQL should not accept public database traffic. PostgreSQL’s documentation requires an SSH server to be running on the same machine as the database server and recommends first confirming that you can log in to that machine with the ssh client. pgAdmin provides an SSH Tunnel tab so it can connect through that intermediary host without requiring a separate manual tunnel command.
Verify the SSH prerequisites
- The VPS must be running an SSH service on the host and port you intend to use.
- Your SSH username must be allowed to log in, and the account must be permitted to reach the PostgreSQL endpoint from the VPS.
- Confirm whether the server policy permits password authentication, identity-file authentication, or both.
- Ensure the SSH host key and account details are known before configuring pgAdmin.
- Keep PostgreSQL’s network listener private if the tunnel is the only intended access path.
Enter the tunnel settings in pgAdmin
- Register a new server in pgAdmin and give it a descriptive name.
- Open the SSH Tunnel tab and set Use SSH tunneling to Yes.
- Enter the VPS SSH host and SSH port. These values identify the SSH service, not necessarily the PostgreSQL service.
- Enter the SSH Username.
- Select the SSH authentication method supported by the server. Enter an SSH password when password login is allowed, or select the identity-file option and provide the private-key file when key authentication is required.
- In the Connection tab, enter the PostgreSQL host and port as seen through the tunnel, together with the maintenance database, PostgreSQL username, and PostgreSQL password. Use the endpoint and bind arrangement defined for the tunnel rather than assuming that the public VPS address is also the database endpoint.
- Save and test the registration. A green status bar indicates that pgAdmin completed the connection.
The two credential sets are independent: the SSH account establishes the transport, while the PostgreSQL role authenticates to the database. A successful SSH login does not prove that the PostgreSQL role, database, or pg_hba.conf rule is correct.
Password versus identity-file SSH authentication
| Method | Use it when | Credential handling |
|---|---|---|
| SSH password | The VPS SSH policy allows password login and your organization accepts interactive password storage or entry. | pgAdmin uses the SSH account password for the tunnel. This is separate from the PostgreSQL password. |
| Identity file | The server requires public-key authentication or your policy avoids SSH passwords. | pgAdmin uses the selected private key. Protect the key file and follow the server’s passphrase and key-management policy. |
Understand the address PostgreSQL sees
An SSH tunnel changes the source address presented to PostgreSQL. The database sees the connection at the SSH server’s bind address, not necessarily the public IP address of your workstation. Therefore, the matching pg_hba.conf entry may need to authorize a local or tunnel-side address. This is why a tunnel can work even when the database port is not exposed publicly, and why a direct-connection rule for your workstation’s CIDR may not match a tunneled session.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Configure SSL when the server requires TLS
SSH encryption and PostgreSQL TLS are separate layers. Use the SSL settings in pgAdmin whenever the PostgreSQL server or your security policy requires TLS, even if the database connection is transported through SSH.
Free tools Windows power users keep installed
One-click scans. No signup required.
In the server registration’s Connection or SSL settings, select the required SSL mode. pgAdmin exposes fields for a root certificate authority, client certificate, client key, and related certificate options. Obtain the exact files and mode from the server administrator; choosing a stricter mode without the corresponding certificates can produce a certificate or verification error, while choosing a weaker mode may violate the server’s policy.
Certificate storage differs between pgAdmin Desktop mode and pgAdmin Server mode. Protect private keys with the permissions and storage controls appropriate to the environment, and avoid placing them in a shared location. If the server requires mutual TLS, both the client certificate and private key must correspond to the trusted certificate chain.
Diagnose failed connections in a deliberate order
Read the complete pgAdmin error and classify the failure before changing settings. The following symptoms point to different layers.
| Symptom | Likely layer | What to check |
|---|---|---|
| Connection timed out | Network path or firewall | Confirm the hostname resolves, the selected host and port are correct, and both the provider firewall and VPS firewall permit the intended source. For a tunnel, test the SSH host and port instead of the database port. |
| Connection refused | No listener or an active reject | Verify that PostgreSQL is running, listening on TCP/IP, bound to the expected interface, and using the port entered in pgAdmin. A refusal commonly indicates a listener or reachability problem rather than a bad password. |
| Server does not listen on TCP/IP | PostgreSQL listener configuration | Inspect listen_addresses and the configured port. An out-of-the-box PostgreSQL server may not listen on TCP/IP at all. |
FATAL: no pg_hba.conf entry |
Host-based authorization | Add or correct a narrow rule for the actual client address, database, role, and authentication method. With SSH, use the address PostgreSQL sees from the tunnel’s bind side. |
FATAL: password authentication failed |
Credentials or authentication configuration | Check the PostgreSQL username and password, confirm that the role is allowed to log in, and verify that the selected pg_hba.conf method matches the credentials. |
| SSH authentication or tunnel error | SSH service or account | Check the SSH hostname, port, username, password or identity file, server-side SSH policy, and whether the SSH service is running on the database machine. |
| SSL certificate, verification, or mode error | TLS configuration | Confirm the required SSL mode, root CA, client certificate, client key, hostname verification expectations, and the certificate files’ readability in the pgAdmin operating mode. |
Use a layer-by-layer test sequence
- Confirm the VPS is powered on and that the hostname resolves to the intended address.
- For direct access, verify the PostgreSQL port is permitted through every firewall and that PostgreSQL listens on the intended interface. For SSH access, verify the SSH port instead.
- Confirm the server registration uses the correct host, port, maintenance database, and username for the chosen design.
- Check the server-side authentication rule. Distinguish a missing
pg_hba.confentry from an incorrect password; they require different fixes. - Only after network and authentication succeed, correct TLS settings or certificate paths if the error specifically identifies SSL.
Security practices that prevent repeat failures
- Prefer an SSH tunnel when PostgreSQL does not need to be a public service.
- If direct TCP is necessary, restrict the provider firewall, VPS firewall, and
pg_hba.confto the smallest practical client CIDR, database, and role. - Do not use broad unauthenticated host rules as a troubleshooting shortcut.
- Keep the PostgreSQL listener, firewall policy, and host-based authentication policy aligned; success at one layer cannot override a denial at another.
- Use TLS when required by the server or policy, and treat SSH as an additional transport layer rather than a replacement for PostgreSQL’s own TLS requirements.
- Protect saved pgAdmin passwords, SSH private keys, client certificates, and CA files on the computer running pgAdmin.
- Recheck settings after PostgreSQL, pgAdmin, the operating system, or the VPS provider changes versions or network controls. UI labels, configuration locations, and service commands can differ by version and distribution.
The Bottom Line
Use an SSH tunnel for the usual administrative case: it keeps PostgreSQL private and avoids opening the database port publicly. Choose direct TCP only when its listener, firewalls, and pg_hba.conf rules can be restricted and maintained. In either design, pgAdmin is only the client interface; PostgreSQL’s listener, network controls, authentication rules, and optional TLS configuration decide whether the connection is accepted.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
