To connect pgAdmin to PostgreSQL on a remote VPS, you must make three layers agree: PostgreSQL must accept TCP connections, the VPS and provider firewalls must pass the traffic, and pg_hba.conf must authorize the client, database, and role. You can connect directly over TCP, or keep PostgreSQL private and let pgAdmin create an SSH tunnel. The tunnel is usually the safer design when the database does not need a public endpoint.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
After the network path is ready, register the server in pgAdmin with the database host, port, maintenance database, role, password or other authentication details, and any required SSL settings. A green status message confirms that pgAdmin established the connection; an error message usually identifies which layer still needs attention.
As an Amazon Associate I earn from qualifying purchases.
What actually controls a remote pgAdmin connection
pgAdmin is the client interface, not the service that makes a remote connection possible. PostgreSQL, the operating-system firewall, the VPS provider’s network controls, and host-based authentication decide whether a connection is accepted.
- PostgreSQL listener: The server must listen on a reachable interface and port. A PostgreSQL installation does not necessarily listen on TCP/IP immediately after installation; its
listen_addressessetting controls this behavior. - Network reachability: Packets must be allowed through the VPS firewall and any provider-level firewall or security group.
- Host-based authentication:
pg_hba.confmust contain a rule matching the connecting address, database, role, and authentication method. - Credentials and encryption: The role password or other configured authentication must be valid, and SSL settings must match the server when TLS is required.
Passing one layer does not override a failure in another. Opening a port in a provider console does not create a PostgreSQL listener, and a permissive pg_hba.conf rule cannot bypass a blocked firewall.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Information to collect before opening pgAdmin
Have these values ready. Confirm each value with the VPS administrator or the PostgreSQL configuration rather than assuming that a familiar default applies.
- The VPS hostname or IP address that is reachable from your workstation, or the SSH host you will use for a tunnel.
- The PostgreSQL port. Port
5432is common, but the configured value may differ. - The database name to use when connecting. pgAdmin labels this field as the maintenance database or database, depending on the version.
- The PostgreSQL login role and its password, or the authentication method configured for that role.
- Whether the database is intended to be reached directly or only through SSH.
- Whether the server requires SSL/TLS, and, if so, the required SSL mode, root CA, client certificate, and client key.
- For an SSH tunnel: the SSH hostname, SSH port, SSH username, and either an SSH password or an identity-file path.
Also verify which pgAdmin mode you are using. Desktop mode stores certificate material on the local computer, while Server mode stores it in the pgAdmin server environment. Private keys must be protected in whichever environment actually uses them.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsChoose direct TCP or an SSH tunnel
Both designs can work. The important difference is where the database endpoint is exposed and which host PostgreSQL sees as the client.
| Consideration | Direct TCP | SSH-tunneled connection |
|---|---|---|
| Database exposure | PostgreSQL listens on an interface reachable from the client, and its database port is allowed through the relevant firewalls. | PostgreSQL can remain private; pgAdmin reaches it through an SSH connection to the VPS. |
| Firewall work | You must allow the database port from the required client CIDR at both provider and VPS firewall layers. | You generally allow SSH access instead; the database port need not be publicly reachable. |
| Operational simplicity | Simple for many clients once routing, listener, firewall, and pg_hba.conf rules are stable. |
Requires a working SSH server and tunnel settings, but avoids publishing a database endpoint. |
| TLS relationship | Use SSL when the server requires or your security design calls for it. | SSH protects the transport between pgAdmin and the VPS, but SSL may still be required by PostgreSQL policy and must be configured independently. |
| Best fit | Controlled networks with a justified need for direct database access. | Administration of a private database or a VPS where exposing the database port is undesirable. |
Choose one design before troubleshooting. Mixing the assumptions of the two designs is a common cause of “it works on the VPS but not from pgAdmin” confusion.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Direct connection: prepare PostgreSQL and the network
1. Make PostgreSQL listen on a reachable interface
Check the server’s listen_addresses setting and the configured port. An out-of-the-box server may not listen on TCP/IP at all. If it listens only on a loopback address, a remote workstation cannot reach it even when the firewall is open.
Use the interface design that matches your risk model. Listening on every interface is broader than necessary; listening on the VPS address or another deliberately selected interface reduces exposure. Exact configuration-file locations and reload commands vary by Linux distribution, PostgreSQL version, and VPS image, so use the conventions for the installed system. After changing the setting, verify that PostgreSQL has reloaded the configuration and is actually listening on the intended port.
2. Permit only the required network traffic
Configure both layers that can filter traffic:
- The VPS operating-system firewall must allow the PostgreSQL port from the client address range.
- The provider’s firewall, security group, or network ACL must allow the same port and source range.
Do not treat an open port as an authorization policy. Restrict the source to a known workstation, office range, VPN range, or other required CIDR instead of allowing every IPv4 or IPv6 address. If your workstation’s public address changes, update the rule deliberately rather than replacing it with a permanent broad rule.
3. Add a matching pg_hba.conf rule
PostgreSQL evaluates host-based authentication rules against the connection’s source address, requested database, role, and authentication method. The rule must therefore match all of those values. Limit the rule to the needed database and role and to the smallest practical client CIDR.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Choose an authentication method that matches the server’s policy. A correct password will still fail if the rule selects a different method, and a rule that authorizes the wrong database or role will produce an authorization error even when the network path works. Avoid broad unauthenticated rules; they can turn a reachable database into an exposed one.
Register the direct connection in pgAdmin
The labels are stable across current pgAdmin releases, but minor wording and layout can vary. The workflow is:
- Open pgAdmin and locate the server tree. Choose Register > Server (or the equivalent Register Server command).
- On the General tab, enter a descriptive name such as the VPS role and environment. This is a local label and does not need to match the PostgreSQL server name.
- Open the Connection tab. Enter the VPS hostname or IP in Host name/address, the configured PostgreSQL port in Port, and the maintenance database or initial database in Maintenance database.
- Enter the PostgreSQL role in Username. Enter its password in the password field. If the computer is private and policy allows it, use pgAdmin’s option to save the password; otherwise leave saving disabled and enter it when prompted.
- If the server requires TLS, configure the SSL fields before testing. Do not select an SSL mode that contradicts the server’s requirement.
- Save the registration and connect. pgAdmin reports a successful connection with a green status bar. An error at this point is useful: preserve its exact wording before changing settings.
For a direct design, the host and port in the Connection tab are the database endpoint that your workstation must reach. They are not the SSH endpoint unless you are using the tunnel workflow described next.
Use pgAdmin’s built-in SSH tunnel
pgAdmin includes an SSH Tunnel tab so it can connect through an intermediary host when the client cannot reach the database directly. The SSH server must be running on the database machine, or on a host that can reach the database, and you must be able to log in with the selected SSH account.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
1. Confirm the SSH prerequisites
- The VPS must be running an SSH server on the host and port you plan to use.
- The SSH account must be permitted to log in and must comply with the VPS provider’s access policy.
- The account needs network reachability from the SSH service to the PostgreSQL endpoint.
- Any provider or VPS firewall must permit SSH from your workstation. Restrict SSH to known source addresses where practical.
PostgreSQL’s documented tunnel model depends on first proving that ordinary SSH login works. If you cannot log in with an SSH client using the same host, port, username, and credential, pgAdmin’s tunnel cannot succeed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →2. Enter the tunnel settings
- In pgAdmin, create or edit the server registration and open the SSH Tunnel tab.
- Set Use SSH tunneling to Yes.
- Enter the SSH host and SSH port for the VPS, then enter the SSH username.
- Select password authentication or identity-file authentication according to the server’s policy. For an identity file, provide the private-key file that the pgAdmin environment can read.
- In the database Connection fields, specify the PostgreSQL host and port as they are reachable from the SSH server. If PostgreSQL is on the same VPS, that commonly means the VPS’s local database endpoint rather than a public address; follow the actual layout of your server.
- Save and connect. pgAdmin establishes the SSH transport and then forwards the database connection through it.
The database does not see your workstation’s public address as the tunnel client. It sees the connection at the SSH server’s bind address. Consequently, the pg_hba.conf rule for a tunnel must authorize that address and the requested database and role. A rule that authorizes your workstation’s public CIDR for direct access may not match a tunneled connection.
Password versus identity-file SSH authentication
| Method | Credential handling | When it fits | Operational cautions |
|---|---|---|---|
| SSH password | pgAdmin prompts for or stores a password, subject to your local security policy. | Environments that explicitly permit password-based SSH and do not require key-only access. | Use the account’s configured policy; a disabled password login cannot be fixed in pgAdmin. |
| Identity file | pgAdmin reads a private key file and uses it for SSH authentication. | Servers configured for key-based or key-only SSH access. | Protect the private key and ensure the pgAdmin Desktop or Server environment has permission to read it. |
Using an SSH tunnel does not remove the need to secure the SSH account, restrict SSH exposure, or configure PostgreSQL authentication correctly.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Configure SSL/TLS when PostgreSQL requires it
Open the SSL section of the pgAdmin server registration and set the SSL mode required by the server. pgAdmin can accept a root CA certificate, client certificate, client key, and related certificate fields. The exact combination depends on whether the server uses server-only certificate validation or mutual certificate authentication.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Certificate paths are environment-specific. In Desktop mode, pgAdmin reads files from the local computer; in Server mode, it reads from the environment where the pgAdmin server process runs. A certificate that exists on your laptop is not automatically available to a browser-based pgAdmin Server deployment. Keep client private keys readable only by the account that needs them.
SSH and TLS solve different problems. SSH provides an encrypted transport to the VPS and hides the database port from the public network. PostgreSQL may still enforce SSL for policy, auditing, or client authentication, so configure both layers when the server requires both.
Read common errors by layer
| Error or symptom | What it usually means | What to check |
|---|---|---|
| Connection timed out | The connection is not reaching a responding service. | Confirm the hostname or IP, route, provider firewall, VPS firewall, source CIDR, and whether the selected port is correct. For a tunnel, check SSH reachability first. |
| Connection refused | The target host was reached, but no service accepted the connection on that address and port, or a firewall actively rejected it. | Verify that PostgreSQL or SSH is running on the expected port, that PostgreSQL is listening on a non-loopback interface for direct access, and that the port in pgAdmin matches the server configuration. |
| “The server does not listen on TCP/IP” | PostgreSQL is not configured to accept TCP/IP connections on the requested interface. | Review listen_addresses, the configured port, and whether the changed configuration was reloaded. A firewall change alone cannot create a listener. |
| “FATAL: no pg_hba.conf entry” | The network path works, but no host-based authentication rule matches the client address, database, role, and authentication method. | For direct access, match the workstation’s source CIDR. For an SSH tunnel, match the address PostgreSQL sees from the SSH server. Also verify the database and role names. |
| “Password authentication failed” | PostgreSQL reached an authentication rule but rejected the supplied credentials or the configured authentication exchange. | Check the role name, password, selected database, authentication method, and whether pgAdmin is using a stale saved password. Re-enter the password rather than assuming the network is at fault. |
| SSH authentication or tunnel failure | pgAdmin could not establish the SSH transport. | Test ordinary SSH login with the same host, port, username, password or key, then verify identity-file permissions and that the SSH server permits the selected method. |
| SSL certificate, mode, or verification error | The client and server disagree about TLS requirements, certificate trust, hostname validation, or client-certificate authentication. | Confirm the server’s required SSL mode and provide the correct CA, client certificate, and key. Check that certificate files are available in the pgAdmin execution environment. |
A repeatable troubleshooting sequence
Change one layer at a time so each result narrows the problem.
- Confirm the VPS is running and that the PostgreSQL service and configured port are known.
- Decide whether the test is direct or tunneled. Do not diagnose a direct firewall rule while pgAdmin is configured to use SSH, or vice versa.
- For a direct test, verify that PostgreSQL listens on the intended interface, then check provider and VPS firewall rules.
- For a tunnel test, prove SSH login independently and confirm that the SSH host can reach the database endpoint.
- Inspect the exact pgAdmin host, port, maintenance database, username, and password fields for typographical errors.
- Read the PostgreSQL error literally. A refusal or timeout is a listener or network issue; an
pg_hba.confmessage is an authorization-rule issue; a password failure is an authentication issue. - Only after the network and authentication path works, troubleshoot SSL certificate details or pgAdmin password storage.
Security checklist for production access
- Prefer an SSH tunnel when there is no operational reason to publish PostgreSQL to the internet.
- If direct access is necessary, restrict firewall sources and
pg_hba.confrules to the required client CIDR, database, and role. - Do not use broad unauthenticated host rules as a quick fix.
- Keep the provider firewall and VPS firewall aligned with the PostgreSQL policy. Both must permit the intended path, and neither replaces the other.
- Use TLS when required by the server or your security policy, including certificate validation and client certificates where configured.
- Protect SSH private keys, PostgreSQL passwords, and client certificate keys. Remove saved credentials when a workstation or pgAdmin deployment is no longer trusted.
- Record which address PostgreSQL sees for each access design so future
pg_hba.confchanges do not accidentally authorize or block the wrong network. - Verify labels and behavior against the installed pgAdmin and PostgreSQL versions. Provider consoles, distribution defaults, configuration paths, and menu wording are not universal.
Which setup should you use?
Use direct TCP only when a controlled set of clients genuinely needs direct database access and you can maintain narrowly scoped firewall and pg_hba.conf rules. Use pgAdmin’s SSH Tunnel tab when PostgreSQL should stay on a private interface, when opening the database port would create unnecessary exposure, or when the VPS already provides a well-managed SSH entry point. In either design, successful registration depends on the same fundamentals: a reachable listener, a permitted network path, a matching host-based authentication rule, valid credentials, and compatible SSL settings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
