Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The safest general pattern is to keep MySQL off the public Internet, open an SSH connection to a host that can reach the database, and forward a free port on your own computer to MySQL through that connection. Run:
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
ssh -N -L 127.0.0.1:13306:127.0.0.1:3306 [email protected]Leave that process running, then configure your MySQL client or GUI for host 127.0.0.1, port 13306, and your normal MySQL username and password. The first 127.0.0.1 is your computer; the second is interpreted from the SSH host’s network.
As an Amazon Associate I earn from qualifying purchases.
What an SSH tunnel changes
A normal remote MySQL connection asks your computer to reach a MySQL listener directly. An SSH local forward changes the path: your client opens a local TCP port, SSH carries those bytes in an encrypted session, and the SSH server opens a connection to the destination host and port. OpenSSH documents local forwarding as forwarding connections from a local TCP port to a host and port on the remote side; Oracle describes the same mechanism as an encrypted SSH tunnel. See the OpenSSH manual and Oracle’s port-forwarding guide.
This is useful when a firewall permits SSH but blocks MySQL from the public network. MySQL can listen only on a private interface or on loopback, while authorized users reach it through the SSH host. The tunnel encrypts the network leg between your computer and the SSH endpoint; MySQL authentication and server hardening still apply separately.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Requirements before you start
- An SSH account: you need a working account on a server reachable from your computer, plus its password or private-key authentication.
- Network reachability from that server: the SSH host must be able to connect to the MySQL destination and port. If the database is on another private machine, routing, DNS and firewall rules must permit the SSH host to reach it.
- A MySQL account: SSH credentials and MySQL credentials are different. Have a MySQL username, password and any required authentication method ready.
- An unused local TCP port: the example uses
13306. You may choose another free port; it does not have to match MySQL’s usual3306. - An SSH client: OpenSSH is available on most Linux and macOS systems and on current Windows installations that include OpenSSH Client. A graphical SSH-capable client can create the same local-forward mapping, but the address and port rules remain identical.
Do not assume that being able to log in by SSH proves that MySQL is reachable. The SSH service and the database may be on different networks, and the database may accept connections only from particular source addresses.
Understand the -L syntax
The general form is:
ssh -N -L local_bind_address:local_port:destination_host:destination_port ssh_user@ssh_hostlocal_bind_addressis where the listener opens on your computer. Use127.0.0.1orlocalhostfor local-only access.local_portis the port your MySQL client uses. It can be any unused local port;13306is merely an example.destination_hostanddestination_portare contacted from the SSH server’s network, not from your original computer.ssh_user@ssh_hostidentifies the SSH account and endpoint that carry the tunnel.
In 127.0.0.1:13306:127.0.0.1:3306, the first address means “listen only on loopback on my computer.” The second means “from the SSH server, connect to its own loopback interface on port 3306.” If MySQL runs on a separate private host, replace the second address with that host’s private DNS name or IP address, for example db.internal.example:3306. Do not replace it with the database’s public name unless that is genuinely how the SSH server reaches the service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
OpenSSH states that binding to localhost limits the listening socket to local use. An empty bind address or * can make the forwarded port available on all interfaces, allowing other machines to use your tunnel. That broader binding is rarely appropriate for a personal database session; see the OpenSSH manual.
Step-by-step: create a local MySQL forward
1. Check the SSH login independently
First establish that the SSH account works:
ssh [email protected]Authenticate, verify that you reached the intended host, and exit. This separates an SSH-account problem from a tunnel or MySQL problem. If your organization requires a particular key, host, port or jump host, use the same SSH options for the tunnel that you use for a normal login.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
2. Start the tunnel
From your client computer, run:
ssh -N -L 127.0.0.1:13306:127.0.0.1:3306 [email protected]-N tells SSH not to run a remote shell command. -L creates the local forward. A successful command normally remains attached to the terminal without printing a prompt: that running process is the tunnel. Keep the window open while you use MySQL.
If the database is on a private host reachable by the SSH server, use its address in the destination portion:
ssh -N -L 127.0.0.1:13306:db.internal.example:3306 [email protected]The SSH server resolves db.internal.example and initiates the database connection. Your laptop does not need a route or DNS entry for that private name.
3. Connect through the local endpoint
In a command-line MySQL client, specify the local endpoint and your MySQL credentials:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
mysql --host=127.0.0.1 --port=13306 --user=YOUR_MYSQL_USER -pThe -p option prompts for the password instead of placing it in the command line. Enter the MySQL password when prompted. The SSH password or key passphrase, if any, was used by the separate SSH process.
For a GUI, create or edit a connection and set:
- Host:
127.0.0.1orlocalhost - Port:
13306(or the local port you selected) - Username and password: the MySQL account, not the SSH account
Do not enter ssh.example.com or the database’s private hostname as the GUI host when you are using a manual local forward. The GUI must connect to the listener on your own computer. MySQL’s Windows procedure describes the same mapping for ODBC applications: establish SSH port forwarding, then use localhost as the MySQL host. See MySQL’s Windows SSH procedure.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →4. End the session
When finished, stop the SSH process with the normal interrupt for your operating system or close its terminal. The local port disappears when the process exits. If you need a tunnel that survives logout or runs continuously, manage the SSH session with your operating system’s service or session-management tools and apply the same local-forward definition; ensure that key protection, logging and restart behavior are appropriate for a persistent service.
When MySQL is on another private server
A common layout has three machines:
- Your workstation, where the MySQL client runs.
- An internet-reachable bastion or administration host, where SSH accepts your login.
- A database server on a private subnet, where MySQL listens on port 3306.
Use the bastion as ssh_host and the database server’s private address as destination_host. For example:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
ssh -N -L 127.0.0.1:13306:10.20.0.15:3306 [email protected]MySQL sees the connection as originating from the SSH host (or from the forwarding connection as configured by the server), not as a direct connection from your workstation. Consequently, the MySQL account’s host restrictions must allow the source that the database actually observes. A successful SSH login alone does not change MySQL grants, TLS settings or firewall rules.
Using MySQL Shell’s SSH support
MySQL Shell can create an SSH tunnel as part of its connection workflow. Its model uses an SSH-server connection specification plus a separate MySQL-server uri. The manual specifically says not to put the MySQL host and port in the base connection parameters when SSH tunneling is used; provide the database target in uri instead. Consult the version-matched MySQL connection-parameters documentation for the exact URI and key-value forms supported by your Shell release.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsMySQL Shell describes the security model as follows: “An SSH tunnel lets unencrypted traffic pass over an encrypted connection, and enables authorized remote access to servers that are protected from outside connections by a firewall.” The statement means that the SSH transport protects the tunnel’s network path; it does not waive MySQL authentication or server security requirements. The MySQL Shell 9.6 User Guide also warns that putting an explicit password in a connection specification is insecure. Prefer interactive prompting or another protected credential mechanism rather than a password embedded in a URI, script argument or shell history.
Manual OpenSSH or MySQL Shell?
| Consideration | Manual OpenSSH forward | MySQL Shell SSH support |
|---|---|---|
| Client compatibility | Any MySQL client or GUI that can connect to a TCP host and port can use the local listener. | Requires MySQL Shell and its supported connection workflow. |
| Setup model | One explicit SSH command, then configure the client for the local port. | SSH and MySQL connection details are represented in Shell’s connection parameters. |
| Credential handling | SSH authentication and MySQL authentication are visibly separate processes. | Shell manages the tunnel workflow; its documentation recommends interactive password prompting instead of explicit passwords. |
| Local exposure | You choose the bind address; 127.0.0.1 keeps the listener local. |
The resulting connection still needs a carefully chosen local endpoint and access policy. |
| Automation | Easy to place in an operating-system session or service manager, provided keys and permissions are protected. | Convenient when your automation already uses MySQL Shell’s connection and scripting features. |
| Observability and reconnects | The SSH process and its terminal output show tunnel failures; persistence and reconnection are your session or service manager’s responsibility. | Behavior follows the MySQL Shell release and connection workflow you use; verify it against the applicable manual. |
| AdminAPI | A tunnel does not make every MySQL Shell AdminAPI operation available. | The 9.6 guide documents SSH-tunneled AdminAPI limitations. |
Security practices that still matter
MySQL’s security guidance warns: “Do not transmit plain (unencrypted) data over the Internet. This information is accessible to everyone who has the time and ability to intercept it.” It recommends an encrypted protocol such as SSL or SSH and identifies SSH port forwarding as an encrypted and compressed tunnel technique. Read the complete MySQL Security Guidelines.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- Keep the bind address local. Use
127.0.0.1orlocalhost. Binding to all interfaces can turn your workstation into a database gateway for other devices on the same network. - Verify the SSH host key. Investigate an unexpected host-key change instead of accepting it automatically; otherwise you can defeat the identity protection SSH provides.
- Use a dedicated, least-privileged SSH account. Grant only the access needed to reach the database and protect its private key and passphrase.
- Keep MySQL authentication and grants least-privileged. The tunnel is not a MySQL login. Use a database account appropriate to the task and review the host part of its account definition.
- Restrict firewall paths. Permit SSH from approved administrative networks and permit the database port from the SSH host or private subnet only. Closing public MySQL access is compatible with this design.
- Consider MySQL TLS separately. SSH encrypts the forwarded transport. Your organization’s MySQL policy may still require MySQL SSL/TLS settings, certificate validation or other database-level controls.
- Protect local credentials. Do not place MySQL passwords in URIs, command histories or scripts when an interactive prompt or protected secret store is available.
Troubleshooting by symptom
“Connection refused” on 127.0.0.1:13306
- Check that the SSH process is still running; closing its terminal closes the listener.
- The selected local port may already be occupied. Choose another unused local port and update the client configuration.
- Inspect the SSH output for a bind failure or a syntax error in the
-Largument. - Confirm that the GUI is using the same local address and port as the command.
SSH connects, but MySQL reports an error
Test the destination from the SSH host itself. Confirm that MySQL is listening on the destination interface and port, that a firewall allows the hop, and that the MySQL account permits the source address MySQL observes. If the database is not on the SSH host, make sure the destination name resolves in the SSH host’s network rather than only on your workstation.
The connection times out
A timeout usually indicates a blocked or unreachable path after SSH authentication. Check firewall rules between the SSH host and database, private-subnet routing, and DNS resolution from the SSH host. A tunnel can be established to the bastion while the bastion still has no route to the database.
Authentication fails
Identify which layer rejected you. An SSH failure concerns the SSH username, key, password, host key or SSH policy. A MySQL authentication failure concerns the database username, password, authentication plugin, account host restriction or database-side policy. Correcting one set of credentials does not correct the other.
The GUI reaches the wrong server
Check the saved connection profile. For a manual tunnel it must use 127.0.0.1 (or localhost) and the local forwarded port, not the database’s public or private hostname. A profile that still points to the remote name bypasses the local listener and may fail or connect to an unintended service.
Important MySQL Shell limitation
The MySQL Shell 9.6 User Guide states that AdminAPI commands are not supported over SSH-tunneled connections except for deployment, start, stop, kill and delete operations for sandbox instances. Treat that as a feature limitation when planning InnoDB Cluster administration or other AdminAPI workflows: a tunnel that works for SQL traffic does not imply that every Shell administration command will work through it. Check the 9.6 User Guide for the operations and release behavior relevant to your environment.
Quick Recap
A practical pre-flight checklist
- Log in to the intended SSH host and verify its identity.
- Confirm that the SSH host can resolve and reach the MySQL destination and port.
- Select an unused local port, such as
13306. - Start
ssh -N -L 127.0.0.1:13306:destination_host:3306 sshuser@ssh_host. - Leave the SSH process running.
- Point the MySQL client or GUI at
127.0.0.1:13306. - Authenticate with the separate MySQL account.
- Stop the tunnel when the work is complete, or place it under a controlled service/session manager only when persistent access is justified.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
