Run the application and database on different hosts, connect them over a private subnet, bind the database listener to its private address, and allow only the application hosts through both network and host firewalls. Keep the database port closed on every public interface. Add database-level authorization, TLS with certificate validation, least-privilege roles, off-host backups, and tests that prove private access works while public access fails.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a private database deployment looks like
PostgreSQL uses a client/server model: the database server process runs on one machine and application clients connect to it over TCP/IP. MySQL and other relational databases use the same basic arrangement. Separating the hosts lets you place the database in a more restricted network segment instead of exposing it alongside public web services.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Internet
|
web/app host (public services + private address)
|
private subnet or VPC (for example, 10.10.0.0/24)
|
database host (private address only for the DB listener)The database host should have a stable private address or internal DNS name. The application host uses that private name or address for connections. The database listener must not bind to a public address or to every interface. A public connection attempt should fail because there is no public route or because the firewall rejects it; an approved application host should succeed over the private route.
A private subnet controls routing exposure, but it does not encrypt packets. TLS is still needed when credentials or data cross a network that other systems could observe or compromise.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Plan the network before installing the database
Choose a non-overlapping private range
Select a private CIDR that does not overlap with the application network, office network, VPN ranges, or other connected environments. The example 10.10.0.0/24 provides a simple isolated segment; use an address plan appropriate to the number of hosts and future connections.
- Reserve a stable private IP or internal DNS record for the database host.
- List every application, migration, reporting, monitoring, and administration host that needs access.
- Decide whether access is by exact host address, a narrowly sized application subnet, or a private service endpoint.
- Plan controlled egress for operating-system updates, monitoring, certificate renewal, and off-host backups if the database host has no public address.
In cloud environments, private services may use provider-managed ranges and VPC peering rather than a subnet you configure directly. For example, regional Cloud SQL private-services deployments can require separate /24 ranges. Confirm the provider’s range and routing requirements before creating firewall rules.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose direct routing, a VPN, or an outbound connector
Direct private routing is the simplest design when the application and database are in the same private network or connected VPCs. A site-to-site or host VPN is useful when the two private networks are separate and must communicate without public database exposure; it adds tunnel operations, routing, and key management.
If a SaaS analytics or data platform must read the database, an outbound connector can avoid inbound firewall changes. Snowflake’s Data Connectivity Proxy, for example, creates one outbound encrypted connection on port 443 and routes requests to private PostgreSQL, MySQL, and similar sources. In that model, the firewall sees outbound traffic and the database does not need a public IP or inbound listener.
Install and bind PostgreSQL or MySQL to the private interface
PostgreSQL
Install PostgreSQL using your operating system’s supported package and initialize the server normally. Locate the active configuration file, then set listen_addresses to the database host’s private address rather than a wildcard.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
listen_addresses = '10.10.0.20'Values such as 0.0.0.0 or * listen on all IPv4 interfaces and are too broad for a private-only database unless another control makes every non-private interface unreachable. Binding directly to the private address provides a stronger, easier-to-audit boundary.
MySQL
Set MySQL’s bind-address to the database host’s private address in the server configuration.
bind-address = 10.10.0.20Restart the database service after changing the listener setting, then inspect the socket from the database host:
ss -lntpFor PostgreSQL, the expected result shows the database port listening on 10.10.0.20, not on 0.0.0.0 or an externally reachable address. If the service still listens broadly, check which configuration file the running instance uses and whether a service manager or container is supplying an override.
Build two firewall layers
Use the network firewall or cloud security group to control traffic before it reaches the host, and the database host’s firewall as a second boundary. Both layers should deny public database access by default.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
| Traffic | Recommended rule | Reason |
|---|---|---|
| Application host to database private address | Allow the database TCP port from the exact application host or narrowly defined application subnet | Provides the required client path without opening the service to unrelated machines |
| Any public or internet source to database | Deny | Prevents direct exposure and internet scanning |
| Administration | Allow only from a controlled management path, such as a bastion or management network | Keeps administrative access separate from application traffic |
| Database outbound traffic | Allow only update, monitoring, certificate, and backup destinations that are genuinely required | Limits unexpected data paths while preserving operations |
Do not treat a successful firewall connection as proof that the deployment is secure. A source that can reach the port still needs a valid database rule, role, password or certificate, and database privilege.
Authorize clients with PostgreSQL rules
PostgreSQL’s pg_hba.conf controls which connection types, databases, roles, and source addresses are accepted. Records are evaluated from top to bottom and PostgreSQL stops at the first match. It does not continue to a later rule after authentication fails, so rule order matters.
A narrowly scoped TLS rule might look like this:
hostssl appdb app_user 10.10.0.10/32 scram-sha-256This illustrative rule means that an SSL connection from one application host can reach appdb as app_user, using SCRAM password authentication. Replace the example names and address with your actual values. If several application hosts are in a dedicated subnet, use that subnet instead of expanding the rule to an unrelated network.
- Specify the exact database instead of
allwhen practical. - Specify the exact role instead of accepting every database user.
- Use the smallest source CIDR that covers the legitimate clients.
- Prefer
scram-sha-256or certificate-backedhostsslrules. - Review earlier rules so a broad entry does not capture the connection first.
Never use a broad trust rule on a network that contains untrusted systems. PostgreSQL documents that trust allows any reachable client to log in as any database user named in the connection request. A password rule without TLS can also expose credentials to a network observer.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesEnable TLS and validate the server identity
Enable PostgreSQL TLS with ssl=on and configure a server certificate and private key. Restrict the key file so only the database service account can read it. In production, use a certificate signed by a CA trusted by the clients, and keep the certificate’s hostname aligned with the name clients use.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
On the client side, merely requesting SSL is weaker than validating the certificate. PostgreSQL’s libpq settings support a trusted root certificate through sslrootcert and hostname verification with verify-full. Configure the application to trust the intended CA and verify the database hostname; otherwise an attacker who gains a position on the private network could impersonate the database.
MySQL deployments should likewise use server certificates, a trusted CA, and hostname verification in the client connector where supported. Keep private keys readable only by the service account and rotate certificates before expiration.
Create roles with least privilege
Use separate identities for distinct jobs rather than sharing a superuser password:
| Role | Typical purpose | Restrictions |
|---|---|---|
| Application | Reads and writes data during normal requests | No schema changes, role management, or server administration |
| Migration | Applies controlled schema changes during deployments | Used only by the migration job and stored separately from the runtime secret |
| Reporting | Runs approved read-only reports | Read-only access to required databases or schemas |
| Administration | Performs maintenance and incident response | Restricted to a management path and protected with stronger operational controls |
Grant only the schema and table privileges each role needs. In PostgreSQL, passing a pg_hba.conf rule is not enough: the role must also have the database’s CONNECT privilege. Restrict CONNECT where appropriate and remove unused accounts.
Back up to a separate failure domain
A private database host is not a backup strategy. Schedule database backups and send copies to storage or another system that would survive loss of the database host. PostgreSQL deployments commonly use scheduled pg_dump jobs for logical backups; choose a physical or managed backup method when recovery objectives require it.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- Keep backup credentials separate from the application credential.
- Encrypt backups in transit and at rest, and limit who can read them.
- Ensure the backup process can read required certificate files without making private keys broadly readable.
- Record retention periods and deletion rules.
- Perform a restore to a clean instance and verify that the application can use the recovered data.
If the database has no public address, provide a controlled outbound path to the backup destination. A server that cannot reach its backup target may appear protected while silently accumulating no recoverable copies.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate the deployment before production
- Check the listener. On the database host, run
ss -lntpand confirm the service is bound only to the private address. - Test an approved client. From the application host, connect to the private DNS name or address and verify the expected database and role.
- Verify TLS. Confirm the client negotiates TLS, trusts the intended CA, and validates the server hostname. Test that an invalid certificate or hostname is rejected.
- Test a denied source. From a host outside the approved source range, confirm that the network firewall or host firewall blocks the database port.
- Check public reachability. From an untrusted or public location, confirm that the database’s public address and database port are unreachable. If the host has no public address, verify that no unintended forwarding or proxy exists.
- Review logs. Inspect firewall and database logs for accepted application connections, rejected source addresses, authentication failures, and unexpected destinations.
- Restore a backup. Recover a recent backup to a clean instance and exercise the application or representative queries.
Repeat these checks after network changes, database upgrades, firewall edits, certificate rotation, or migration to a new host.
Recommended Free Tools
Self-managed server versus managed private database
Both models can keep the database off the public internet, but they move responsibility to different teams.
| Decision axis | Self-managed database host | Managed private database |
|---|---|---|
| Operating system and database settings | Full control over packages, extensions, parameters, and placement | Provider controls much of the host and supported configuration |
| Private-network integration | You design subnets, routes, firewalls, and any VPN | Provider supplies a private endpoint or VPC integration; you still configure client-side access |
| Patching, monitoring, failover | Your team owns scheduling, tooling, alerts, and recovery procedures | Provider may supply built-in options, but service limits and configuration still require review |
| Backup and restore | You schedule off-host copies and test restores | Provider may automate backups, but retention, export, and restore testing remain your responsibility |
| Portability | Usually easier to reproduce the same operating-system and database configuration elsewhere | Check provider-specific extensions, networking, backup formats, and migration limits |
Choose self-management when you need operating-system control, unusual extensions, or a specific placement and have staff for patching, backups, monitoring, failover, and firewall operations. Choose a managed service when reducing host operations is more valuable and its private-network, backup, and configuration limits fit the workload.
Quick Recap
Common failure modes and fixes
The application times out
- Confirm the application is using the database’s private DNS name or address, not a stale public address.
- Check routes, VPC peering, VPN status, and security-group rules.
- Confirm the database listener is bound to the address that the application is contacting.
- Check the host firewall and verify that the source address seen by the database matches the allowed CIDR.
The port is reachable but login fails
- Inspect
pg_hba.confordering and confirm the first matching record uses the intended authentication method. - Verify the role, database name, password or certificate, and database
CONNECTprivilege. - Check that the client is using TLS when the rule is
hostssl.
TLS verification fails
- Install the correct CA certificate in the application trust store.
- Use the certificate’s DNS name in the connection string and enable hostname verification.
- Check certificate expiration, key permissions, and whether an intermediate CA is missing.
Backups succeed locally but cannot be recovered
- Confirm copies are stored off-host and are not dependent on the same disk or machine.
- Run a real restore, not only a backup job status check.
- Test that encrypted backup credentials and certificate files are available to the recovery process without exposing private keys.
Final security checklist
- Database listener bound to the private interface only.
- Network and host firewalls allow only named application sources.
- No public ingress to the database port.
- PostgreSQL authorization rules specify exact databases, roles, source CIDRs, and ordered secure methods.
- TLS is enabled, private key permissions are restrictive, and clients validate the issuing CA and hostname.
- No broad
trustrule or clear-text password authentication on an untrusted network. - Application, migration, reporting, and administration roles are separated and least-privileged.
- Backups are scheduled, off-host, access-controlled, and restore-tested.
- Private access, public denial, denied-source behavior, logs, certificate failure, and recovery have all been tested.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
