How to connect to your MySQL database remotely

Connect a local client to your TurboStack database securely over an SSH tunnel.

Connect a database client on your own computer (for example TablePlus, DBeaver or HeidiSQL) to a MySQL database on your host. The recommended, secure way is an SSH tunnel.

Why the database port is not open by default

For security, MySQL listens on localhost only (mysql_bindaddress: "127.0.0.1"), so the database port is not reachable from the internet. Rather than exposing it, you forward it over your existing SSH access - the connection is encrypted and uses your SSH key.

  1. Open a tunnel from a local port (here 3307) to the database on the host: 
    ssh -L 3307:127.0.0.1:3306 prod@web1.example.com
    Leave this session open while you work.

  2. Point your client at the local end of the tunnel:

    Setting Value
    Host 127.0.0.1
    Port 3307
    User your database user (from Credentials)
    Password the database user's password
    Database your database name, for example prod_db

Many clients (TablePlus, DBeaver, HeidiSQL) can also create the SSH tunnel for you - choose "SSH" or "connect over SSH" and give your SSH host and key; then set the database host to 127.0.0.1.

Opening the port instead (advanced)

If a tool genuinely cannot tunnel, you can widen the bind address and allow specific source IPs - but this exposes the database, so prefer the tunnel.

  • Set mysql_bindaddress to a non-local address in the host configuration (see Configure MySQL).

  • Allow only the exact source IP addresses on the host's Security tab (Security). Adding an IP to the allow-list there also opens the otherwise blocked database port to it.

  • Connect with a least-privilege user, never the application's main user.

Troubleshooting

  • Connection refused - the tunnel is not open, or the client is pointing at the host instead of 127.0.0.1.

  • Access denied - wrong user/password, or the user is not allowed from your host (see Create and manage database users).

  • Times out when opening the port directly - the source IP is not on the allow-list, or mysql_bindaddress is still local. See Database problems.

© 2026 Hosted Power — TurboStack