Recommended Free Tools
Use MySQL Workbench’s Standard TCP/IP over SSH connection method. Workbench logs in to your VPS through SSH, creates an encrypted port forward, and then connects to MySQL through that forward. In the MySQL fields, enter the database address as seen from the VPS—usually 127.0.0.1 or localhost—not the VPS address you entered for SSH.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
You authenticate separately to the Linux account over SSH and to the MySQL account inside the tunnel. This keeps MySQL’s port private while still allowing your desktop Workbench session to administer the database.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat you need before configuring Workbench
Gather these details first. The SSH account and the MySQL account are normally different identities, even when their names happen to match.
- A VPS DNS name or IP address and the SSH port. Port
22is common; use your actual custom port if the server uses one. - A non-root Linux account that can log in over SSH.
- An OpenSSH private key and the matching public key installed in that account’s
~/.ssh/authorized_keysfile. Workbench recommends key authentication. - A running MySQL or compatible server on the VPS, plus a database username, password, and the server’s listening port. The conventional port is
3306, but verify your configuration. - Permission for the SSH daemon to create TCP forwards and firewall rules that allow SSH from your network.
- MySQL listening on an interface reachable from the VPS itself. When MySQL and the SSH endpoint are on the same VPS, a private or loopback bind is preferable to exposing port
3306publicly.
Test ordinary SSH access before opening Workbench. If a terminal cannot log in with the same host, port, account, and key, Workbench’s tunnel cannot succeed either.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
How the Workbench SSH tunnel works
With Standard TCP/IP over SSH, Workbench starts an SSH session to the VPS and forwards a local connection through that encrypted session. The remote end of the forward connects to the MySQL host and port you specify in the MySQL section. The database does not need to accept connections from the public internet.
That creates two authentication steps:
- SSH authentication: Workbench proves it may log in as the Linux user on the VPS, normally with an OpenSSH private key.
- MySQL authentication: MySQL then checks the database username, password, authentication plugin, and privileges.
“Localhost” is evaluated from the tunnel’s server-side perspective. If MySQL runs on the same VPS as the SSH daemon, 127.0.0.1 means the VPS itself. It does not mean your laptop. Entering the VPS’s public IP as the MySQL hostname can fail when MySQL is bound only to loopback, and opening MySQL publicly just to make that address work weakens the design.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Prepare the VPS for a private database connection
Create a dedicated SSH login
Use a named, non-root account for administration. Install your public key in that account’s authorized_keys file, confirm the file and its parent directory have appropriate ownership and permissions, and verify that key-based SSH works before disabling any other login method. Do not put an SSH password in a Workbench profile or a connection string.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Allow forwarding, but keep the database private
The SSH daemon must permit TCP forwarding. If your server configuration disables it, Workbench may authenticate successfully and still fail while opening the tunnel. Check the daemon’s forwarding setting and reload the service only after validating the configuration.
Keep MySQL bound to a local or private interface when the database and SSH endpoint share the VPS. Permit inbound traffic to the SSH port from the networks that need it, but do not add a public firewall rule for MySQL merely to support Workbench. If the database is on another private host, the MySQL hostname must be an address resolvable and reachable from the VPS, and the private network firewall must allow the VPS to reach the database port.
Confirm the database listener
Verify that MySQL is running and listening on the port you plan to enter. A service listening on a custom port, a container-only address, or a different private interface must be addressed with that exact host and port in Workbench. The SSH tunnel cannot repair a stopped service or an unreachable remote network.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Configure Standard TCP/IP over SSH in MySQL Workbench
- Open Workbench’s connection manager and create a new connection.
- Choose Standard TCP/IP over SSH as the connection method.
- Fill in the SSH and MySQL fields using the values below.
- Save the profile without embedding a plain-text password, then select Test Connection.
| Workbench field | What to enter | Why it matters |
|---|---|---|
| SSH Hostname | The VPS DNS name or IP, optionally including the SSH port, such as vps.example.com:22 |
This is the machine Workbench contacts first. Use the same host and port that succeed in ordinary SSH. |
| SSH Username | The Linux account used to log in to the VPS | This is an operating-system identity, not necessarily the MySQL user. |
| SSH Key File | The path to an OpenSSH private key | Workbench recommends an SSH key. A PuTTY .ppk file is not accepted directly as the default key format; convert it to OpenSSH format with PuTTYGen and select the converted private key. |
| MySQL Hostname | 127.0.0.1 or localhost when MySQL runs on the VPS; otherwise, the database address reachable from the VPS |
This hostname is resolved on the remote side of the tunnel, not on your desktop. |
| MySQL Server Port | 3306 unless your MySQL server uses another port |
The tunnel’s destination must match the listener configured on the database host. |
| Username | The MySQL database account | It is independent of the SSH username and must have the required database privileges. |
| Password | The MySQL account’s password, supplied through Workbench’s protected prompt or credential storage | Do not place an explicit password in a connection specification or public documentation. |
For a normal single-VPS installation, a typical profile therefore uses the VPS address in SSH Hostname, the Linux administrator account in SSH Username, an OpenSSH key in SSH Key File, and 127.0.0.1 with port 3306 in the MySQL section.
When the database is on a different private host
The SSH endpoint and MySQL server do not have to be the same machine. In that arrangement, enter the database host’s private DNS name or private IP in MySQL Hostname. The VPS must be able to resolve and route to that address, and its firewall or security group must permit the connection. Using localhost in this case would point to the VPS, not the separate database server.
Verify the VPS host key on the first connection
On the first SSH connection, Workbench may ask you to accept the VPS host fingerprint. Compare it with a fingerprint obtained through a trusted administrative channel before accepting it. This check confirms that you are talking to the intended server rather than an intercepted endpoint.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Workbench records known hosts under ~/.ssh/known_hosts on Linux and macOS. On Windows, it uses a Workbench-created known-hosts file under the user profile. A later change to the stored fingerprint produces an error. Treat that as a security event: verify whether the VPS was rebuilt, its SSH host keys were rotated, or the DNS and IP now point somewhere unexpected. Do not simply delete the old entry and reconnect without investigating.
Test the connection and interpret the result
Click Test Connection. A successful test means Workbench authenticated to SSH, created the forward, reached the configured MySQL host and port from the VPS, and authenticated the MySQL account. Open a SQL editor only after this test succeeds.
If the test fails, identify which layer failed rather than changing every field at once. Workbench’s connection log is the most useful first diagnostic after reproducing the error.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Troubleshoot tunnel and login failures
| Symptom | Likely cause | What to check or change |
|---|---|---|
| Workbench cannot establish the SSH connection | Wrong hostname, port, username, key, or a firewall blocking SSH | Run ordinary SSH with exactly the same host, port, account, and private key. Correct the network rule or Workbench field before troubleshooting MySQL. |
| “Could not open SSH tunnel” after SSH authentication | TCP forwarding is disabled on the SSH server, or a firewall rejects the forwarding path | Confirm the SSH daemon permits TCP forwarding and inspect both local and VPS firewall rules. A valid key alone does not guarantee forwarding. |
| Private key rejected or unreadable | The selected file is a PuTTY .ppk, the path is wrong, or the client cannot read the file |
Convert the key to OpenSSH format with PuTTYGen, select the resulting private key, and check file permissions and readability. |
| SSH succeeds but MySQL connection is refused | MySQL is stopped, listening on another port or interface, or the hostname is wrong | From the VPS, verify the service is running and listening. Use 127.0.0.1 for a loopback-bound local database, or the private address of a separate database host. |
| Connection times out while MySQL is running | The VPS cannot route to the database host, or an internal firewall blocks the database port | Check private-network routes, security groups, and host firewalls from the VPS side. The destination must be reachable from the SSH server, not merely from your laptop. |
| “Access denied” from MySQL | Wrong database password, account, authentication plugin, host restriction, or missing privileges | Test the MySQL credentials separately on the server and confirm that the account is allowed from the connection origin used by the tunnel. |
| Host-key or fingerprint mismatch | The VPS was rebuilt, keys changed, DNS changed, or an interception is possible | Stop and verify the server identity through a trusted channel. Update the known-hosts entry only after the change is explained. |
| Workbench behaves differently from a terminal tunnel | Different key, SSH port, user, destination host, or local configuration | Compare every value and inspect Workbench’s connection log. The two clients must use the same SSH endpoint and remote MySQL destination. |
Separate SSH diagnosis from MySQL diagnosis
First prove that the SSH session works. Next prove that the VPS can reach the database host and port. Only then investigate the MySQL account. This order prevents an incorrect database password from being mistaken for a tunnel problem and prevents a disabled forward from being mistaken for a MySQL outage.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use a manual SSH tunnel when several tools need the same forward
Workbench manages the tunnel for a single saved connection. A manually created local forward can be useful when several clients share one SSH session, when you want to keep the tunnel lifecycle independent of Workbench, or when an SSH configuration or bastion workflow already exists.
A standard local-forward pattern is:
ssh -L 13306:127.0.0.1:3306 [email protected]Here, local port 13306 is forwarded through the VPS to 127.0.0.1:3306 as seen by the VPS. While that SSH session remains open, a client on your computer can connect to 127.0.0.1 on port 13306. Use your real Linux account, VPS name, SSH key, and SSH port; do not expose the local forwarded port beyond the interfaces that need it.
In this manual arrangement, Workbench uses the ordinary TCP/IP method against the local forwarded endpoint, while SSH handles the tunnel separately. If the SSH process exits, the local database connection stops. Workbench’s integrated method is usually simpler for one GUI profile; a manually managed forward is more flexible for multiple clients or persistent operations.
Quick Recap
| Approach | Exposure | Configuration | Authentication and operations |
|---|---|---|---|
| Workbench-managed SSH tunnel | MySQL remains behind the SSH service; no public MySQL listener is required | One saved GUI profile, with SSH and MySQL fields together | SSH key plus separate MySQL credentials; tunnel starts for the Workbench connection |
Manual ssh -L tunnel |
Also keeps the database path behind SSH when the destination is private | Requires a separate SSH command or SSH configuration | Useful when several local clients share one tunnel or an external service manages its lifetime |
| Direct public MySQL access | Exposes another network service and expands the attack surface | Requires public MySQL binding and additional firewall controls | Database authentication is exposed directly to the network; avoid this when an SSH tunnel meets the need |
Security practices that prevent common mistakes
- Use least privilege: connect over SSH with a named non-root account and grant the MySQL account only the database privileges it needs.
- Protect private keys: keep the OpenSSH private key out of public repositories, shared documents, screenshots, and support tickets. Use an agent or protected credential store where appropriate.
- Keep credentials out of connection strings: MySQL guidance warns that specifying an explicit password in a connection specification is insecure and not recommended. Prefer an interactive prompt or protected storage.
- Restrict network exposure: allow SSH only from necessary source networks, and leave MySQL on a private or loopback interface when the tunnel terminates on the same VPS.
- Validate fingerprints: a changed SSH host key is not a routine warning to dismiss. Establish why it changed before trusting the replacement.
- Use separate identities: the SSH Linux account and MySQL account serve different control planes. Rotating one credential does not rotate the other.
- Document custom ports: record the SSH port and MySQL port beside the server’s operational notes so a future administrator does not “fix” a working private setup by opening port
3306publicly.
Quick configuration checklist
- Log in to the VPS with the intended non-root account using the same OpenSSH key.
- Confirm the SSH daemon permits TCP forwarding and that firewalls allow the SSH port.
- Confirm MySQL is running and note its listening host and port.
- In Workbench, select Standard TCP/IP over SSH.
- Enter the VPS DNS name or IP in SSH Hostname, with the SSH port if needed.
- Enter the Linux account in SSH Username and select the OpenSSH private key.
- Enter
127.0.0.1orlocalhostfor a MySQL service on that VPS, or the database’s private address when it is elsewhere. - Enter the verified MySQL port, account, and password without placing the password in a URL or shared text.
- Verify the VPS fingerprint on first use and investigate any later mismatch.
- Run Test Connection, then use the Workbench log to identify whether a failure is at SSH, forwarding, network reachability, or MySQL authentication.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
