phpMyAdmin Works but MySQL Workbench Can’t Connect

If phpMyAdmin works but MySQL Workbench can’t connect to your VPS, the cause is almost always that MySQL is bound to localhost only, or the MySQL user you’re using is restricted to localhost, or the server’s firewall is blocking port 3306. phpMyAdmin runs on the same server as MySQL, so it connects through a local socket or 127.0.0.1, bypassing network restrictions. MySQL Workbench, however, connects over TCP/IP from your local machine, so it needs MySQL to listen on a public interface, a user allowed to connect from your IP, and port 3306 open in the firewall.

How phpMyAdmin and MySQL Workbench Connect Differently

phpMyAdmin is a web-based tool that runs on the same server as MySQL. When you open it in your browser, the PHP code on the server connects to MySQL using a local connection—either through a Unix socket (on Linux) or via 127.0.0.1. This local connection is always allowed and doesn’t require network configuration.

MySQL Workbench is a desktop application that runs on your local computer. It connects to the MySQL server over the network using TCP/IP on port 3306. This requires three things:

• MySQL must be configured to listen on an external interface (not just localhost).
• The MySQL user you’re using must be allowed to connect from your IP address (or a wildcard like ‘%’).
• Port 3306 must be reachable through the server’s firewall and your VPS provider’s security group.

If any of these is missing, Workbench fails with errors like “Can’t connect to MySQL server on ‘x.x.x.x’ (10060)” or “Access denied for user ‘user’@’localhost’.”

Common Causes and How to Fix Them

Here are the most frequent reasons, in order of likelihood, and how to resolve each:

1. MySQL is bound to localhost only. The default configuration in many distros sets bind-address = 127.0.0.1 in my.cnf or mysqld.cnf. Change it to 0.0.0.0 (or a specific public IP) and restart MySQL.
2. User is restricted to localhost. When you create a user with CREATE USER 'user'@'localhost', it can only connect from the server itself. Create another user with 'user'@'%' or 'user'@'your-ip' and grant the needed privileges.
3. Firewall blocks port 3306. On Ubuntu/Debian, run sudo ufw allow 3306/tcp. On CentOS/RHEL, use sudo firewall-cmd --add-port=3306/tcp --permanent and reload. Also check your VPS provider’s control panel for a security group or firewall rules—many block 3306 by default.
4. MySQL is not listening on the expected interface. Use netstat -tlnp | grep 3306 to see if it’s listening on 0.0.0.0:3306 or just 127.0.0.1:3306.
5. SELinux or AppArmor blocking. On CentOS, SELinux may block MySQL from binding to non-standard ports or connecting. Check with getenforce and temporarily set to permissive to test. On Ubuntu, AppArmor profiles for MySQL might restrict network access—check /etc/apparmor.d/usr.sbin.mysqld.

Step-by-Step: Configure MySQL for Remote Access

Follow these steps to enable MySQL Workbench to connect:

1. SSH into your VPS.
2. Edit the MySQL configuration file. On Ubuntu/Debian, it’s usually /etc/mysql/mysql.conf.d/mysqld.cnf; on CentOS, /etc/my.cnf. Find the line bind-address and set it to 0.0.0.0.
3. Restart MySQL: sudo systemctl restart mysql (or mysqld on CentOS).
4. Create or modify a user for remote access. In MySQL shell, run:
   CREATE USER 'workbench'@'%' IDENTIFIED BY 'strongpassword';
GRANT ALL PRIVILEGES ON *.* TO 'workbench'@'%' WITH GRANT OPTION;
FLUSH PRIVILEGES;
5. Allow port 3306 through the firewall as described above.
6. Test from your local machine using mysql -h your-vps-ip -u workbench -p (if the mysql client is installed) or try Workbench again.

If you still get “Access denied”, double-check the user’s host. MySQL matches hostnames and IPs exactly, so 'user'@'%' does not match 'user'@'localhost'—you need both if you want to connect locally and remotely.

Security Considerations for Opening MySQL to the Internet

Opening port 3306 exposes your database to the internet. This increases the risk of brute-force attacks and exploits. To mitigate:

• Use a strong, unique password for remote users.
• Restrict the user’s host to your specific IP instead of ‘%’ if possible.
• Use a firewall rule that only allows your IP address to connect to port 3306.
• Consider using SSH tunneling instead of opening the port. Connect via SSH and forward port 3306 locally: ssh -L 3306:localhost:3306 user@vps-ip, then connect Workbench to 127.0.0.1.
• Disable remote root login (already disabled by default in most setups).

SSH tunneling is often the safest option because it doesn’t expose MySQL to the public internet at all.

Alternative Tools and Approaches

If you prefer not to open port 3306, or if you need a quick solution, consider these alternatives:

• SSH tunneling as described above—works with Workbench and any MySQL client.
• Adminer or DBeaver—both can use SSH tunnels and may be easier to configure.
• Change the default port to a non-standard one (e.g., 3307) to reduce automated scans, but note that this adds complexity.
• Use a VPN to access your VPS network securely.

These options give you the same functionality without exposing MySQL directly.

Frequently Asked Questions

Why does phpMyAdmin work even when MySQL is bound to localhost? Because phpMyAdmin runs on the same server, so it connects via the local socket or 127.0.0.1, which is always allowed. It never uses the network interface.

I changed bind-address to 0.0.0.0 but still can’t connect. What else? Check the firewall and the user’s host. Also verify that MySQL actually restarted and is listening on 0.0.0.0 with netstat. Sometimes there are multiple config files, and the one you edited isn’t the one being read.

Can I use the same user for phpMyAdmin and Workbench? Yes, but you need to create the user with a host of ‘%’ or your specific IP. If you only have ‘user’@’localhost’, phpMyAdmin will work but Workbench won’t. Create a separate user for remote access to be safer.

Is it safe to open port 3306? It’s not recommended unless you have strong security measures. A firewall rule limited to your IP is acceptable, but SSH tunneling is safer. Many VPS providers block 3306 by default for this reason.

What does “Can’t connect to MySQL server (10060)” mean? This error means the connection timed out—the server is not reachable on that port. It’s usually a firewall issue or MySQL not listening on the public interface.

Why does Workbench work from my home but not from another network? Your home IP might be allowed in the user’s host or firewall, but the other network has a different IP. Update the user’s host to ‘%’ or add the new IP to the firewall rules.

Related

• Star Wars AI Effects Backlash: Why Fans Reacted
• Where to Start With Zelda: A Beginner’s Guide
• 37signals Internal Communication: Principles and Practices