Connect to MySQL on Another VPS via Private IP

This guide explains how to connect to a MySQL server running on one VPS from another VPS using their private network IPs. Private IP connections are faster, more secure (traffic never leaves the provider’s network), and avoid public exposure of your database. You’ll need root or sudo access on both servers, and the MySQL server must already be installed and running.

What You’ll Need

Two VPS instances from the same provider (so they share a private network).
Root or sudo access on both servers.
MySQL or MariaDB installed on the server that will host the database.
A MySQL client (usually mysql) on the server that will connect.
The private IP address of the MySQL server (find it with ip addr or hostname -I).

Step-by-Step

Find the private IP of the MySQL server. Log in to the MySQL server VPS and run ip addr show or hostname -I. Look for an IP in a private range like 10.x.x.x, 172.16.x.x, or 192.168.x.x. Note this address.
Configure MySQL to listen on the private IP. Edit the MySQL configuration file (usually /etc/mysql/mysql.conf.d/mysqld.cnf or /etc/my.cnf). Find the line bind-address and set it to the private IP, e.g., bind-address = 10.0.0.2. If the line is commented out, uncomment it. If you want MySQL to listen on all interfaces (not recommended), use 0.0.0.0.
Restart MySQL. Run sudo systemctl restart mysql (or mariadb if using MariaDB). Verify it’s running with sudo systemctl status mysql.
Create a MySQL user for remote access. Log into MySQL as root: sudo mysql. Then create a user that can connect from the other VPS. Use a strong password. For example:
```
CREATE USER 'appuser'@'10.0.0.3' IDENTIFIED BY 'StrongPassword123!';
```
Replace 10.0.0.3 with the private IP of the client VPS. If you want to allow any host, use '%', but this is less secure.
Grant privileges to the new user. Give the user access to the database(s) they need. For example:
```
GRANT ALL PRIVILEGES ON mydatabase.* TO 'appuser'@'10.0.0.3';
```
Then run FLUSH PRIVILEGES; and exit with EXIT;.
Check the firewall on the MySQL server. If you use UFW, allow MySQL connections from the client’s private IP: sudo ufw allow from 10.0.0.3 to any port 3306. If you use firewalld, use sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.3" port port="3306" protocol="tcp" accept' and reload. If no firewall is active, skip this step.
Test the connection from the client VPS. From the client VPS, run:
```
mysql -h 10.0.0.2 -u appuser -p
```
Enter the password when prompted. If you get a MySQL prompt, the connection works.
Make the connection persistent (optional). If your application needs to reconnect automatically, consider using a configuration file like ~/.my.cnf on the client with the credentials, but be careful with permissions.

Common Mistakes

Using the wrong bind-address. Setting it to 127.0.0.1 only allows local connections. Setting it to 0.0.0.0 exposes MySQL to the internet if the firewall isn’t configured.
Forgetting to restart MySQL after changing the config file.
Creating a user with a host that doesn’t match. If the client’s IP changes (e.g., DHCP), the connection will fail. Use a static private IP or a hostname.
Firewall blocking port 3306. Even if MySQL is listening, the firewall may drop packets. Check with sudo ufw status or sudo firewall-cmd --list-all.
Using the public IP instead of the private IP. This defeats the purpose and may be blocked by the provider.

Tips

Use a dedicated MySQL user with only the necessary privileges (e.g., SELECT, INSERT, UPDATE) rather than ALL PRIVILEGES.
Prefer private IPs over public IPs for internal communicationâ€”they’re faster and don’t incur bandwidth charges.
Set a strong password and consider using MySQL’s VALIDATE_PASSWORD plugin to enforce complexity.
Use SSH tunneling if you need to connect from outside the private network securely.
Test with a simple query like SELECT 1; to verify the connection before integrating with an application.

Troubleshooting

Connection refused (error 2003): This usually means MySQL isn’t listening on the expected IP/port. Check netstat -tlnp | grep 3306 on the server. If it shows 127.0.0.1:3306, the bind-address is wrong. If it shows 0.0.0.0:3306, it’s listening on all interfaces, which is fine as long as the firewall restricts access.
Access denied for user (error 1045): The user/host combination is wrong, or the password is incorrect. Double-check the user creation and try connecting locally on the server with the same user.
Can’t connect via private IP but works via public IP: The private network may not be enabled on both VPS, or the routing is misconfigured. Check with ping <private-ip> from the client. If it fails, contact your provider.
Timeout (error 2002): The firewall is likely dropping packets. Verify the firewall rules on the server and ensure the client IP is allowed.
MySQL won’t start after changing bind-address: Check the error log (/var/log/mysql/error.log) for syntax errors or permission issues. Ensure the IP is valid and not already in use.

Frequently Asked Questions

Can I use a hostname instead of an IP?

Yes, if your DNS resolves the hostname to a private IP. You can also add an entry in /etc/hosts on the client.

Is it safe to expose MySQL to the private network?

Generally yes, because the private network is isolated from the internet. However, other tenants on the same provider might have access, so always use strong passwords and restrict the user to specific hosts.

What if my VPS provider doesn’t offer a private network?

You can still connect over the public internet, but you must secure it with SSH tunneling or a VPN. Alternatively, use a tool like mysql over an SSH tunnel.

How do I change the MySQL port?

Edit the port directive in the MySQL config file and restart. Then connect with mysql -h <ip> -P <port>.

Can I connect to MySQL from a Docker container?

Yes, but the container must be on the same network or use the host’s IP. Ensure the firewall allows the container’s IP.

What if I get ‘Host is not allowed to connect to this MySQL server’?

This means the user’s host doesn’t match the client’s IP. Recreate the user with the correct host or use '%' if you trust the network.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →