To connect Navicat to a remote MySQL or MariaDB server, you need four correct connection values—host, port, username and password—plus a server account that permits your client’s source IP and a network path to the database port. Create a MySQL connection in Navicat, enter those values on the General tab, and verify that firewalls and security groups allow the port. If the database port is intentionally blocked, enable Navicat’s SSH tunnel and connect through an SSH server that can reach the database.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What must be ready before you open Navicat
A remote connection succeeds only when both transport and MySQL authorization are configured. Collect the following from the database or server administrator:
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- The database server’s DNS host name or IP address. Use the exact host supplied by the administrator; a web-site address is not necessarily the database host.
- The TCP port on which MySQL or MariaDB is listening. Port 3306 is the MySQL default, but an administrator or hosting provider may assign another port.
- A database username and password intended for remote use.
- The public IP address, or approved public range, from which your Navicat computer will connect.
- The database name and the minimum operations your work requires, such as reading, writing or administering schema.
- Whether the server requires SSL/TLS, an SSH tunnel or an HTTP tunnel instead of an exposed database port.
Keep the server’s firewall, cloud security-group rules and MySQL account settings in scope. A correct password cannot compensate for a blocked port, and an open port cannot compensate for an account whose host rule or privileges do not match.
Configure a direct TCP connection in Navicat
Use a direct connection when the database listener is reachable from your network and the administrator deliberately permits your source IP.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
1. Create a MySQL connection
- Open Navicat and choose the command to create a new MySQL connection.
- In the connection dialog, open the General tab. Navicat 17 documents the connection name, host, port, user name and password fields for MySQL/MariaDB connections in its official manual.
- Enter a descriptive connection name, such as
Production game database. This label is local to your Navicat installation and does not change the server. - Enter the remote database host name or IP address in the host field.
- Enter the server’s actual MySQL port. Use
3306only when the administrator confirms that the listener uses the default. - Enter the permitted database username and its password.
- Save the connection and use Navicat’s test or connect action.
If the test reports a transport failure, fix DNS, routing or firewall access before changing credentials. If the server responds but rejects the login, investigate the MySQL account’s host pattern and privileges.
Allow the client in MySQL without over-permissioning it
MySQL evaluates a remote login in two stages: it determines whether the account matches the connecting host, then checks that account’s privileges. The username alone is not enough. An account created only for localhost can still reject a correct password when the request arrives from your public IP.
Match the account to the source host
Ask the administrator to create or update an account whose host component matches your public IP or an explicitly approved range. If your ISP changes your public address, the old host rule may stop matching even though Navicat’s settings have not changed.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Navicat’s help guidance shows this illustrative syntax:
GRANT ALL PRIVILEGES ON *.* TO 'YourUserName'@'YourPublicIP' IDENTIFIED BY "YourPassword";That example demonstrates the account-and-host form and grants global privileges; it should not be copied unchanged for a production database. Use the server’s supported account-creation syntax for its MySQL/MariaDB version, restrict the host to the required address or range, and grant only the required database privileges. The relevant Navicat explanation is available in its privilege-system guidance.
Grant only the database operations the connection needs
- For reporting, use a read-only account scoped to the required database.
- For an application or content workflow, grant only the tables and operations it must change.
- Reserve global privileges and administrative accounts for maintenance tasks that genuinely require them.
- Do not use a wildcard host such as an unrestricted remote pattern when a fixed public IP or narrow range is available.
After the administrator changes the account, reconnect from the same network used by Navicat. A grant for one public IP will not match a connection that exits through a different VPN, office gateway or mobile network.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Open the correct network path
The MySQL listener, host firewall and any cloud security group must all permit the path from your client network to the selected port. Navicat’s troubleshooting guidance recommends checking the hostname, port and firewall rules before treating every failure as a password problem; see Why I cannot connect to my server.
Verify the hostname and DNS
Resolve the supplied host name from the same computer and network where Navicat runs. Confirm that it resolves to the intended database server, not to a web server, old address or private address that is reachable only inside the provider’s network.
Verify the listening port
Ask which port the server actually listens on and compare it with the General-tab value. The default is 3306, but a nonstandard port is common when several database services share a host or when an administrator changes the exposure policy.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Check firewalls and security groups
The client’s network may be blocked by an outbound policy; the server may block inbound traffic; and a cloud security group may allow only selected source addresses. Permit the chosen source IP and port narrowly rather than opening the database listener to the entire internet. If the administrator cannot expose the port, use an SSH tunnel instead of weakening the firewall.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDistinguish the failure stage
- No route, timeout or connection refused: investigate DNS, routing, listener status, firewalls and security-group rules.
- A server response followed by an access-denied message such as error 1045: check the username, password, account host pattern and granted database privileges.
- Intermittent success: check whether your ISP, VPN or office gateway changes the public source IP, and whether DNS returns multiple addresses with different reachability.
Use an SSH tunnel when direct MySQL access is blocked
An SSH tunnel is the practical fallback when a hosting company or firewall permits SSH but blocks outside connections to the database port. Navicat describes the benefit this way: “The major benefit of SSH tunneling is that it allows us to connect to a MySQL server from behind a firewall when the MySQL server port is blocked.” The hosting-specific procedure is documented at Navicat’s SSH-tunneling help page.
Information required for the tunnel
- The SSH server host name or IP address.
- The SSH port, commonly
22, unless the administrator uses another port. - An SSH username.
- Either an SSH password or a private-key authentication method accepted by the server.
- The database host and port as seen from the SSH server.
Configure the tunnel in Navicat
- Create or edit the MySQL connection and open the SSH settings.
- Enable Use SSH tunnel.
- Enter the SSH server host and SSH port, then provide the SSH username and the permitted password or private key.
- Leave the database host and database port in the General tab set to the address and port that the SSH server can reach. This may be a private address or
127.0.0.1on the remote machine, not the public address you would use from your desktop. - Save the connection and test it. Navicat first authenticates to SSH, forwards the database traffic through that server, and then authenticates to MySQL using the General-tab database credentials.
The SSH server must itself be allowed to reach the database host and port. A successful SSH login does not prove that MySQL is listening or accessible from that server. Conversely, the MySQL account’s host rule must match the source that the database sees—often the SSH server’s address rather than your home or office IP.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Common tunnel mistakes
- Entering the desktop’s public IP as the database host when the database is bound to a private network reachable only from the SSH server.
- Using the SSH password in the MySQL password field, or vice versa.
- Forwarding to port 3306 when the remote listener uses a custom port.
- Allowing SSH from your IP but forgetting to allow the SSH host to reach the database through its own firewall or security group.
- Using a private key that is not in the format or location accepted by your Navicat edition.
Choose among direct TCP, SSH, HTTP tunnel and SSL/TLS
These options solve different problems and can sometimes be combined. Direct TCP determines how Navicat reaches MySQL. SSH and HTTP tunnels carry that traffic through another service. SSL/TLS encrypts the database protocol and authenticates the server according to its certificate policy. Navicat for MySQL lists SSH, HTTP Tunnel and SSL/TLS among its secure connection methods in its feature matrix.
| Method | Is the database port publicly reachable? | What the server side must provide | Authentication involved | When it fits |
|---|---|---|---|---|
| Direct TCP | Yes, from the approved client network | MySQL listener plus firewall/security-group access and a matching MySQL host rule | MySQL username and password; SSL/TLS may also be required | The administrator intentionally exposes a restricted database port |
| SSH tunnel | No; MySQL can remain private behind the SSH host | An SSH service that can reach the database, plus MySQL access from that SSH host | SSH password or private key, then MySQL credentials | A firewall or hosting provider blocks external MySQL but permits SSH |
| HTTP Tunnel | No direct MySQL exposure to the client | An HTTP-tunnel endpoint supported and configured for the environment | Depends on the tunnel endpoint and its policy | An environment provides an HTTP path but not direct TCP or SSH access |
| SSL/TLS | It does not decide exposure by itself | Server certificate/CA policy and a MySQL listener reachable by the chosen transport | MySQL credentials plus certificate validation or client-certificate requirements when configured | Encryption and server identity are required by the database policy |
Do not treat SSL/TLS as a substitute for firewall rules: an encrypted listener can still be exposed too broadly. Likewise, a tunnel protects the route but does not make a weak MySQL account safe.
Recommended Free Tools
Configure SSL/TLS when the server requires it
Obtain the certificate authority, client certificate or key files, verification mode and hostname policy from the database administrator. In Navicat’s SSL/TLS settings, select the options that match that policy rather than disabling verification to bypass an error. The certificate’s expected server name may differ from the IP address; use the documented host name when certificate validation requires it.
Test TLS over the same transport you intend to use. A direct connection may use the public listener, while an SSH-tunneled connection may use a private database host; the certificate policy still belongs to the MySQL server. If the server requires TLS and Navicat is configured for plain traffic, the network can be reachable while authentication fails during protocol negotiation.
Troubleshoot a Navicat remote connection systematically
“Cannot connect” or a timeout
- Confirm DNS resolves the administrator-provided host from the client computer.
- Confirm the port in Navicat matches the actual listener, including any nonstandard port.
- Check outbound rules on the client network and inbound firewall/security-group rules on the server.
- Confirm the MySQL service is running and not bound only to an internal interface or localhost.
- If the provider blocks external database access, stop testing direct TCP and ask whether SSH tunneling is supported.
“Access denied” or error 1045
- Re-enter the database username and password; do not substitute the SSH credentials.
- Check the MySQL account’s host component against the source address the server actually sees.
- Verify that the account has privileges on the selected database and that the requested operation is permitted.
- Check for a changed ISP, VPN or office public IP that no longer matches the account rule.
SSH succeeds but MySQL fails
Test the database host and port from the SSH server’s network, not from your desktop. Correct the General-tab database host if it points at a public address unavailable from the tunnel host, and confirm that MySQL permits the SSH server’s source host.
The connection works once and then stops
Recheck the client’s current public IP, DNS records, rotating security-group rules and tunnel credentials. A static Navicat profile does not update automatically when an ISP changes the address that MySQL uses for host matching.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Security checklist for a maintainable connection
- Restrict MySQL access to a known public IP or narrow approved range.
- Use a dedicated account for the Navicat task instead of a global administrative account.
- Grant only the required database and table operations.
- Prefer SSH tunneling when direct exposure is unnecessary or prohibited.
- Use SSL/TLS when required by the server’s certificate policy, and preserve certificate verification.
- Keep SSH keys and database passwords out of shared documents and rotate them according to the administrator’s policy.
- Record the actual host, port, tunnel endpoint and account host rule so future IP or firewall changes can be diagnosed quickly.
Quick connection checklist
- Have the administrator confirm the database host, listener port and approved source network.
- Create a new MySQL connection in Navicat.
- Enter the connection name, host, port, username and password on the General tab.
- Confirm DNS and firewall/security-group reachability.
- Confirm the MySQL account’s host pattern and least-privilege grants.
- Enable SSL/TLS if required.
- If direct access is blocked, enable Use SSH tunnel, enter SSH details and set the database host to one reachable from the SSH server.
- Test again and classify any error as transport, tunnel, TLS or MySQL authorization before changing settings at random.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
