Reaching a database from outside the server
Screen walkthrough with on-screen captions, no narration. Plays on this page, muted, no sign-in needed. Every name, address and figure on screen is an example.
Databases stay closed to the outside by default. Every site on your estate talks to its own database over a local socket, so there is no listening surface to defend and no password anyone can try from the internet. That silence is worth keeping.
Occasionally something legitimately sits elsewhere: a schema tool on your desk, a reporting job on another box, an application that reads a site it does not live with. Remote MySQL is where you name those few callers, and the video above walks the panel end to end.
The wildcard is an off switch dressed as a shortcut
The panel will accept %, meaning anyone. People reach for it when their office address keeps moving, and it undoes the entire arrangement in one keystroke. After that your data is guarded by a password alone, on a port that scanners sweep continuously.
Where the address genuinely drifts, two answers keep the list honest: route through a VPN with a stable exit, or skip the whole question and tunnel the port over SSH. Neither costs more than the wildcard once it is set up.
Why the note field earns its place on a network
Across a dozen accounts you will end up with dozens of allowed hosts. In a year, an address with no note beside it is undeleteable in practice, because nobody can say what breaks if it goes. An address annotated reporting box, added for the client dashboard can be removed with confidence the day that dashboard is retired.
Treat the list the way you treat user accounts: additions are cheap, and the discipline is in the removals.
Allowing a host is not granting rights
Two separate things have to be true for a remote connection to work:
- The address is on this list.
- A database user exists and has rights on that database.
Adding the host alone gets you a connection that is then refused at login, which reads like the host entry not working. Check the user before assuming the address is wrong. Knowing which database belongs to which site saves time here too, because the user you need rights on is rarely the one you first reach for.
When it fails
Three checks, in this order. Is your real outbound address the one in the list, rather than the one your provider showed you last month? Does a user with rights on that specific database exist? And can traffic on port 3306 leave your network at all? Corporate and cafe networks block that port far more often than people expect, and the resulting silence is indistinguishable from a refusal at the far end.
Still not sure which way to go?
Tell us what you are building. If it needs less than you think, we will say so.