A plugin's MySQL settings work fine from inside the panel's database tools and refuse to connect the moment they are pointed at the node's public IP. That is not a misconfigured plugin — it is a firewall doing exactly what it is supposed to do.
Why the public path is closed on purpose
The database port is closed to external connections at the firewall, independent of whatever password protects it. This is defence in depth: a database's own authentication is a much thinner line of defence than never being reachable from the public internet at all, and closing the port removes an entire category of attack — credential stuffing, brute-forcing, exploiting a database-server vulnerability — before it can even begin, regardless of how strong the plugin's stored password is.
Connecting the way that actually works
- Open the Databases tab in the panel
It shows the correct host address for that specific database — typically a local or container-network address, not the node's public IP.
- Use that exact address in the plugin's configuration
Traffic between the game server and the database over that internal path never crosses the firewall rule blocking external access, because it never leaves the local network in the first place.
- Restart the plugin or the server
Most database plugins only read their configuration once, on startup.
Closing the direct, public route to something sensitive and requiring it go through a controlled internal path is the same defensive pattern applied twice on this platform, not two unrelated rules.