How to connect to your PostgreSQL database remotely
Connect a database client on your own computer (for example pgAdmin, DBeaver or psql) to a
PostgreSQL database on your host. The recommended, secure way is an SSH tunnel.
Why the database port is not open by default
For security, PostgreSQL listens on localhost only (postgresql_listen_addresses: "localhost"), so
the database port is not reachable from the internet. Rather than exposing it, you forward it over
your existing SSH access - the connection is encrypted and uses your SSH key.
Connect over an SSH tunnel (recommended)
- Open a tunnel from a local port (here
5433) to the database on the host:Leave this session open while you work.ssh -L 5433:127.0.0.1:5432 prod@web1.example.com -
Point your client at the local end of the tunnel:
pgAdmin and DBeaver can also create the SSH tunnel for you - set the SSH host and key, then set the
database host to 127.0.0.1.
Opening the port instead (advanced)
If a tool genuinely cannot tunnel, you can widen access - but this exposes the database, so prefer the tunnel.
-
Widen
postgresql_listen_addressesand add host-based rules withpostgresql_extra_accessfor the specific networks or hosts that need it (see Configure PostgreSQL). -
Also allow the exact source IP addresses on the host's Security tab (Security).
-
Connect with a least-privilege role, never the application's main role.
Warning
Never open the database broadly. Grant access only to specific, trusted hosts, and use a dedicated limited role.
Troubleshooting
-
Connection refused - the tunnel is not open, or the client is pointing at the host instead of
127.0.0.1. -
Authentication failed - wrong role/password, or no matching host-based access rule (see Create and manage PostgreSQL users).
-
Times out when opening access directly - the source host is not allowed, or
postgresql_listen_addressesis still local. See Database problems.
Related
- Configure PostgreSQL
- Create and manage PostgreSQL users
- Import and export a database
- SSH access
- Host Security tab