Your server.
Within reach.

Prepare the database on your server

This walkthrough assumes a Linux VPS running MariaDB and SSH on the same machine. You need an SSH login and a separate database login. Keep MariaDB listening on server loopback; public port 3306 can stay closed.

Ask your database administrator to create a password account for TCP loopback access. For MariaDB, run the following in an administrator SQL console. Replace the password placeholder locally with a unique password, and replace FiveM if your database has another name.

CREATE USER 'astral_client'@'127.0.0.1'
  IDENTIFIED BY 'REPLACE_WITH_A_UNIQUE_PASSWORD';
GRANT SELECT ON `FiveM`.*
  TO 'astral_client'@'127.0.0.1';

This starts with read access. Request only the write or schema privileges you need. Do not reuse phpMyAdmin’s internal service account. Verify the new login over TCP on the server; a UNIX-socket login alone does not verify this route.

mariadb --protocol=TCP --host=127.0.0.1 --port=3306 --user=astral_client --password FiveM

If access is denied, have the administrator check the account host and authentication method. MySQL account matching may differ. See MariaDB accounts and database privileges.

Open your private tunnel

On your Windows PC, open PowerShell. Replace SSH_USER with your server login and SERVER_HOST with its IP or hostname. These are SSH details, not your phpMyAdmin login.

ssh -N -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -L 127.0.0.1:13306:127.0.0.1:3306 SSH_USER@SERVER_HOST

Verify the server fingerprint with your host before accepting it. Authenticate when prompted and leave this window open; a quiet terminal is normal. If your host uses another SSH port, add -p SSH_PORT. If ssh is missing, install OpenSSH Client through Windows Optional Features. OpenSSH forwarding reference.

Connect in Astral

Engine

MariaDB (or MySQL for a MySQL server)

Server host

127.0.0.1

Port

13306

Database

FiveM — replace with your database name

Username

astral_client — your database account

Password

The database password you created

TLS mode

Disabled only for the same-server SSH tunnel above

Choose Test connection, then connect. For this specific tunnel, both unencrypted database hops stay on loopback; SSH encrypts traffic between the machines. Use TLS if your server requires it. A separate database host behind the SSH server needs TLS on that additional hop.

Keep the tunnel running during your session. Close it with Ctrl+C when finished. Astral does not start or maintain SSH tunnels automatically.