Can’t Connect to VPS MySQL from Workbench? Fixes

If you can’t connect to a MySQL server on a VPS from MySQL Workbench, the fix is almost always one of three things: MySQL is only listening on localhost (127.0.0.1), the server’s firewall is blocking port 3306, or MySQL Workbench is using the wrong connection method (SSH vs. TCP/IP). This article walks through each cause in order of likelihood and gives exact steps to resolve them.

Why MySQL Workbench Can’t Reach Your VPS

MySQL Workbench connects to a remote server over TCP/IP on port 3306 by default. For that to work, three separate layers must all allow the connection:

• MySQL itself must be configured to listen on an external interface, not just 127.0.0.1.
• The server firewall (ufw, firewalld, or cloud security groups) must permit inbound traffic on port 3306 from your IP.
• MySQL user permissions must allow the user to connect from your IP address, not just ‘localhost’.

If any one of these is wrong, you’ll see an error like “Can’t connect to MySQL server on ‘x.x.x.x’ (10061)” or “Connection refused.” The steps below address each layer.

Step 1: Check MySQL’s Bind Address

By default, MySQL on Linux listens only on 127.0.0.1. This is a security measure—it means the server won’t accept remote connections at all. To check, run on the VPS:

sudo netstat -tlnp | grep 3306

If you see 127.0.0.1:3306 in the output, MySQL is bound to localhost only. To fix it, edit the MySQL configuration file (usually /etc/mysql/mysql.conf.d/mysqld.cnf or /etc/my.cnf) and change the line:

bind-address = 127.0.0.1

to

bind-address = 0.0.0.0

Then restart MySQL: sudo systemctl restart mysql. After restart, netstat should show 0.0.0.0:3306 or :::3306.

If you don’t want to expose MySQL to the whole internet, you can bind to a specific IP address (e.g., bind-address = 192.168.1.100) or use an SSH tunnel instead (see Step 4).

Step 2: Open Port 3306 in the Firewall

Even if MySQL listens on all interfaces, the server’s firewall may block external access to port 3306. The exact commands depend on your firewall:

• UFW (Ubuntu/Debian): sudo ufw allow from YOUR_IP to any port 3306 (replace YOUR_IP with your home IP). Then sudo ufw reload.
• Firewalld (CentOS/RHEL): sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="YOUR_IP" port port="3306" protocol="tcp" accept' then sudo firewall-cmd --reload.
• Cloud security groups (AWS, DigitalOcean, etc.): Log into your cloud provider’s dashboard, find the firewall/security group settings, and add an inbound rule for TCP port 3306 from your IP.

Restricting to your IP is much safer than allowing from anywhere (0.0.0.0/0). If your IP is dynamic, you may need to update it periodically.

Step 3: Create or Update the MySQL User

MySQL users are tied to a host. The default root user often only allows connections from ‘localhost’. To connect remotely, you need a user that can come from your IP. On the VPS, run:

mysql -u root -p

Then create a new user or alter an existing one:

CREATE USER 'workbench'@'YOUR_IP' IDENTIFIED BY 'strong_password_here';
GRANT ALL PRIVILEGES ON *.* TO 'workbench'@'YOUR_IP' WITH GRANT OPTION;
FLUSH PRIVILEGES;

You can also use 'workbench'@'%' to allow from any IP, but that’s a security risk. If you use a VPN or a static IP, prefer the specific IP.

If you already have a user but it’s only for ‘localhost’, you can change it:

RENAME USER 'oldname'@'localhost' TO 'oldname'@'YOUR_IP';

Or create a new user and drop the old one. After this, test the connection from your local machine using the MySQL client: mysql -h YOUR_VPS_IP -u workbench -p. If that works, Workbench will also work.

Step 4: Use an SSH Tunnel Instead (Safer)

If you don’t want to open port 3306 to the internet at all, you can use MySQL Workbench’s SSH tunneling feature. This is often the best solution because it encrypts the connection and doesn’t require exposing MySQL publicly.

In MySQL Workbench, when setting up a new connection:

1. Choose Connection Method = Standard TCP/IP over SSH.
2. Enter the SSH hostname (your VPS IP), SSH port (22), and your SSH username (e.g., root or ubuntu).
3. Choose an SSH authentication method (password or key file).
4. In the MySQL section, set the hostname to 127.0.0.1 and port to 3306—because the SSH tunnel makes it look like MySQL is on your local machine.
5. Enter the MySQL username and password (the one that works from localhost).

With this method, you don’t need to change the bind-address or open port 3306 in the firewall. The SSH tunnel carries the traffic securely. The only requirement is that SSH (port 22) is reachable.

Common Pitfalls and Misconceptions

• Using ‘localhost’ in Workbench: When connecting remotely, the MySQL host must be the VPS’s IP or domain, not ‘localhost’. ‘localhost’ means your own machine.
• Firewall on your local machine: Sometimes the issue is your own firewall or ISP blocking outbound port 3306. Try a different network or check with your ISP.
• MySQL is not running: Check with sudo systemctl status mysql. If it’s not running, start it.
• SELinux (CentOS/RHEL): SELinux can block MySQL from listening on non-standard ports or connecting. Check with getenforce. If it’s enforcing, you may need to set the correct boolean: sudo setsebool -P mysql_connect_any 1 (but this is rare for default installs).
• IPv6 vs IPv4: If your VPS uses IPv6 and you’re trying to connect via IPv4, you may need to use the IPv6 address or ensure MySQL is listening on both. Usually binding to 0.0.0.0 covers IPv4 only; to also cover IPv6, bind to :: as well (or use bind-address = * in some versions).

Frequently Asked Questions

Why do I get “Access denied for user ‘root’@’your-ip'”?

This means MySQL is reachable, but the user ‘root’ is not allowed to connect from your IP. You need to create a user that is allowed from your IP or change the host for the root user (not recommended). Follow Step 3 to create a dedicated remote user.

Can I use the same port for SSH and MySQL?

No, they are different protocols and must use different ports. SSH uses 22, MySQL uses 3306. If you want to avoid opening 3306, use SSH tunneling as described in Step 4.

What if my VPS is behind a NAT or a cloud load balancer?

If your VPS is behind a NAT, the public IP may not be the same as the server’s IP. You need to configure port forwarding on the NAT device to forward 3306 to the VPS’s private IP. Cloud load balancers usually require you to add a TCP listener for 3306 and forward to the instance’s private IP.

Is it safe to open port 3306 to the internet?

It’s risky. MySQL is a common target for brute-force attacks. If you must open it, restrict the source IP to your own address, use a strong password, and consider using a VPN. The safest approach is SSH tunneling or a VPN.

Why does Workbench time out even though I can ping the VPS?

Ping uses ICMP, which is separate from TCP port 3306. The port may be blocked, or MySQL may not be listening. Check the bind-address and firewall as described above. Also, some cloud providers block all ports except 22, 80, 443 by default.

I changed the bind-address, but now MySQL won’t start. What’s wrong?

Make sure you didn’t make a syntax error in the config file. Also, on some systems, you need to set mysqlx-bind-address as well if you use MySQL X Protocol. Check the error log at /var/log/mysql/error.log for details.

Related

• Motorola Edge 70 Pro 5G vs Nothing Phone 4b: Which to Pick?
• PS3 Restore: Will It Erase Data? Each Option
• Jump for Animals Codes: What They Are & How to Use