How to Connect to MySQL Remotely (Safely)

The safest way to connect to a MySQL or MariaDB database from your computer is through an SSH tunnel: the database stays closed to the internet, and your client connects through an encrypted SSH connection. If SSH is not available, cPanel's Remote MySQL feature can allow connections from your specific IP address only. Avoid opening the database to all addresses.

Option 1: SSH tunnel (recommended)

An SSH tunnel forwards a port on your computer to the database on the server, through SSH.

Requirements: SSH access to the hosting account or server, ideally with key authentication. See how to set up SSH key authentication.

From the command line

ssh -N -L 3307:127.0.0.1:3306 user@your-server

• 3307 is the local port on your computer (choose any free port).
• 127.0.0.1:3306 is the database as seen from the server.
• Keep this command running while you work.

Then connect your client to host 127.0.0.1, port 3307, with the database username and password.

In a GUI client

Most database tools (MySQL Workbench, DBeaver, HeidiSQL, TablePlus and others) have an SSH or SSH tunnel tab: enter the server, SSH username and key, then the database host 127.0.0.1 and port 3306 as seen from the server.

Option 2: cPanel Remote MySQL (allow-list your IP)

If your host allows it and SSH is not available:

1. Find your public IP address (search "what is my IP").
2. In cPanel, open Databases → Remote MySQL.
3. Add your IP address as an Access Host, with a comment describing it.
4. Connect your client to the server's hostname (as shown in cPanel), port 3306, with the database username and password.

Remove the access host when you no longer need it. If your IP changes (common on home connections), update the entry.

On your own VPS

On a VPS, the database usually listens only on localhost, which is good. Prefer the SSH tunnel. If remote access is truly required (for example from another application server):

• bind MySQL to a private network address rather than a public one where possible;
• allow port 3306 in the firewall only from the specific IP; see Linux firewall basics;
• create a user restricted to that host ('app'@'10.0.0.5');
• require TLS for the connection.

Troubleshooting

Error	Likely cause
Connection timed out	Port blocked by firewall, or Remote MySQL not configured
Access denied for user	Wrong credentials, or user not allowed from your host
Host is not allowed to connect	Your IP is not in the allow-list (or it changed)
SSH tunnel connects but database refuses	Using localhost vs 127.0.0.1 mismatch; try 127.0.0.1
Too many connection errors, host blocked	Repeated failures; ask support or run FLUSH HOSTS on your server

Security tips

• Use a database user with only the privileges you need for the task.
• Never store database passwords in plain-text files on shared computers.
• Close the tunnel and remove access hosts when finished.

See database security best practices.

Worked example: a tunnel to a cPanel database with DBeaver

You want to browse your shop's database from your laptop. Your hosting plan includes SSH on port 2222, your cPanel username is acme, and the database is acme_shop.

1. In DBeaver, create a new MySQL (or MariaDB) connection.
2. Main tab: Host 127.0.0.1, Port 3306, Database acme_shop, username and password of the database user.
3. SSH tab: enable Use SSH Tunnel, Host = your server hostname, Port 2222, User acme, Authentication = Public Key, and select your private key file.
4. Click Test Connection. DBeaver opens the tunnel and connects through it.

Nothing about the database needs to be opened to the internet, and the connection is encrypted by SSH.

Exporting or importing large databases remotely

For databases too large for phpMyAdmin uploads, the tunnel lets you use command-line tools from your computer:

# Export through the tunnel on local port 3307
mysqldump -h 127.0.0.1 -P 3307 -u acme_dbuser -p --single-transaction acme_shop > acme_shop.sql

# Import into another database through the tunnel
mysql -h 127.0.0.1 -P 3307 -u acme_dbuser -p acme_shop_staging < acme_shop.sql

Use --single-transaction for InnoDB tables so the export is consistent without locking the live site. For more on keeping database access tight, see database security best practices and how to set up SSH key authentication.

Frequently Asked Questions

Is phpMyAdmin a safer alternative?

phpMyAdmin in cPanel runs on the server and does not require opening the database port, so for occasional tasks it avoids remote access altogether.

Why does my host not offer Remote MySQL?

Some hosts disable it for security. Use SSH tunnelling or phpMyAdmin instead.

Related reading

Create the database first with how to create a MySQL database in cPanel. For full control over database access, see the ServerNeed VPS plans.

Running your own database server? Start with what is a VPS.

Sources

• cPanel documentation: Remote MySQL
• MySQL Reference Manual: Using encrypted connections