Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Run the application and database on different hosts, but keep the database on a private subnet with no public listener. Bind PostgreSQL (or MySQL) to the database server’s private address, allow only the application host or subnet through network and host firewalls, enforce database-level authorization, and use TLS with certificate validation. A private IP controls routing exposure; it does not replace authentication, encryption, backups, or monitoring.
What a private database deployment looks like
In a separate-server deployment, the application connects to a database process over TCP/IP rather than using a local socket. PostgreSQL’s documentation describes this as a client/server model: the server process runs on one machine and clients connect from another.
Internet | web/app host (public services and private address) | private subnet or VPC (for example, 10.10.0.0/24) | database host (private address for the database listener)
The database host can have a public address for administration or updates, but the database service should not listen on that interface. The safer design is a database host with only a private address and a controlled egress path for package updates, monitoring, and off-host backups. Without egress, those operational functions may fail.
Use a stable private address or internal DNS name for the database. The example addresses in this guide are illustrative: an application at 10.10.0.10 and a database at 10.10.0.20 on 10.10.0.0/24. Choose a non-overlapping CIDR that will not conflict with another office, cloud VPC, VPN, or partner network.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Why isolation requires more than a private IP
A private subnet prevents ordinary Internet routing to the database, but it does not automatically prevent another host on that subnet from trying to connect. It also does not encrypt packets inside the network. OpenStack’s security guidance recommends allowing database communication only across an isolated management network, and OWASP recommends isolating the backend database and limiting it to as few connecting hosts as possible.
- Exposure: the listener is reachable only on the private interface, never on a public interface.
- Network policy: cloud security groups, network ACLs, routers, and the host firewall allow the database port only from named application sources.
- Database policy: PostgreSQL authorization rules identify the source CIDR, database, role, and authentication method.
- Encryption: TLS protects credentials and data if a private link is monitored or misrouted.
- Recovery: backups leave the database host and are tested by restoring to a clean instance.
A VPN can extend a private network between sites or clouds, but it is not a substitute for database authentication and TLS. Keep the same listener and firewall restrictions across a VPN link.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Plan the network before installing the database
Choose the address space and route
Reserve a private CIDR, a database address, and an internal DNS name such as db.internal.example. Confirm that the route exists from every application host that needs access and from no broader network than necessary. In a cloud environment, use the provider’s private-service mechanism or VPC peering rather than assigning a public database endpoint. Google Cloud documents private services access for Cloud SQL as VPC peering that lets VPC clients communicate by private IP without external IP addresses; some regional deployments require a separate /24 range.
Define the allowed clients
Write down the exact application hosts, migration runners, reporting jobs, and administrators that require access. Prefer individual host addresses or a small application subnet over an entire corporate network. Decide whether administration will occur through a bastion host, a private management network, or an approved VPN.
Plan operational egress
A private-only database still needs a path to receive security updates, send monitoring data, and upload backups. Use a NAT gateway, egress proxy, or private service endpoint with an allow-list. Egress should be narrower than unrestricted Internet access and should not create an unintended route for database clients.
Install the server and bind it to the private interface
PostgreSQL
Install PostgreSQL using your operating system’s supported package and verify the service starts. Find the active configuration file from a local administrative session with:
sudo -u postgres psql -c 'SHOW config_file;'Set listen_addresses to the database host’s private address, for example:
listen_addresses = '10.10.0.20'Do not use 0.0.0.0 or * unless you deliberately intend to listen on every interface. Ubuntu’s PostgreSQL guidance notes that those values listen broadly. After changing the setting, restart or reload PostgreSQL according to your package’s service instructions, then inspect the socket:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
ss -lntp | grep 5432The result should show 10.10.0.20:5432 (or the chosen private address), not 0.0.0.0:5432 or a public address.
MySQL or a compatible server
Locate the active server configuration and set bind-address to the private address:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
bind-address = 10.10.0.20Restart the service and inspect the listening socket. MySQL commonly uses TCP port 3306; PostgreSQL commonly uses 5432. Use the port configured on your installation rather than assuming the default.
Verify name resolution
From an application host, resolve the internal name and confirm it returns the private address. Make sure public DNS does not publish the database address and that split-horizon DNS, if used, returns the private record only to authorized networks.
Build two firewall layers
Network or cloud firewall
Create an inbound rule on the database subnet, security group, or provider firewall that allows the database TCP port only from the application host address or application subnet. Deny public Internet sources and remove temporary broad rules created during installation. If migrations or reporting run on separate hosts, add those hosts explicitly rather than opening the port to an entire VPC.
Host firewall
Repeat the restriction on the database server’s local firewall. A host rule should express the same intent as the network rule: allow TCP 5432 from 10.10.0.10/32 for PostgreSQL, or the configured MySQL port from the approved source, and deny other inbound traffic. Keep outbound rules tight enough to prevent unexpected data paths while allowing updates, monitoring, DNS, and the backup destination.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTest both paths
From an allowed application host, test the private address and expected port. From an untrusted host or public location, confirm that the port is unreachable rather than merely refusing authentication. A closed or filtered port is preferable to a public service that exposes a database banner.
Authorize PostgreSQL clients with ordered rules
PostgreSQL uses pg_hba.conf for host-based authentication. Each record specifies the connection type, database, role, source CIDR, and authentication method. PostgreSQL evaluates records from top to bottom and stops at the first match; it does not continue to a later record after an authentication failure.
A narrow example for an application at 10.10.0.10 is:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
hostssl appdb app_role 10.10.0.10/32 scram-sha-256For a migration runner on a separate address, add a separate rule with its own role and source:
hostssl appdb migration_role 10.10.0.30/32 scram-sha-256hostssl requires TLS. scram-sha-256 provides password authentication stronger than legacy password methods. Avoid broad trust rules: PostgreSQL documents that trust allows any reachable client to log in as any database user. Also avoid an unqualified rule such as “all databases, all users, all private subnet” when only one application needs access.
After editing pg_hba.conf, reload PostgreSQL and test each intended and denied source. Passing pg_hba.conf is not sufficient by itself: the role must also have the CONNECT privilege on the target database.
Enable TLS and validate the certificate
Enable PostgreSQL TLS with ssl=on and configure the server certificate and private-key files. Restrict the key so only the database service account can read it; PostgreSQL will reject or weaken a deployment with overly permissive key permissions. Use a certificate signed by a trusted internal or public CA in production, with a subject name matching the internal DNS name clients use.
On the client, configure a trusted root certificate and hostname verification. A libpq-style connection can look like:
psql 'host=db.internal.example dbname=appdb user=app_role sslmode=verify-full sslrootcert=/etc/ssl/db-ca.pem'sslmode=verify-full validates both the issuing CA and the server name. Merely requesting SSL without validating the certificate protects against passive sniffing but is weaker against an active impersonator. Test that a wrong hostname or untrusted certificate fails, and that the expected certificate identity succeeds.
For MySQL, enable the server’s TLS settings and configure clients to verify the CA and server identity using the equivalent verification mode. Do not treat a private route as encryption.
Create roles with least privilege
Separate application traffic, schema migrations, reporting, and administration. An application role normally needs only the tables, sequences, functions, and schema it uses; it should not own the database or have superuser rights. A migration role can receive broader DDL privileges and be used only by a controlled deployment process. Reporting should use a read-only role.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Illustrative PostgreSQL setup:
CREATE ROLE app_role LOGIN PASSWORD 'use-a-secret-from-a-secret-manager';
CREATE DATABASE appdb;
GRANT CONNECT ON DATABASE appdb TO app_role;
GRANT USAGE ON SCHEMA public TO app_role;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO app_role;Apply default privileges for future objects and keep administrative credentials out of application configuration. Store secrets in an access-controlled secret manager, rotate them, and audit role membership. Restrict database CONNECT where appropriate so a valid role cannot use the server as a gateway to unrelated databases.
Back up off the database host
Schedule logical or physical backups according to your recovery objectives, then copy them to a separate failure domain. OWASP recommends regular backups, and private-network deployment guidance specifically calls for scheduled pg_dump backups shipped off the server.
pg_dump --format=custom --file=/var/backups/appdb-$(date +%F).dump appdbThat command is an example, not a complete retention policy. Encrypt backups in transit and at rest, limit who can read them, and keep credentials separate from the database service account. Ensure the backup process can read the required certificate files without making private keys broadly readable.
Perform a restore to a clean instance on a schedule. A backup that has never been restored is an assumption, not a recovery plan. Record the restore result, schema version, row counts or application health checks, and the time required to make the restored service usable.
Validate before production
- Check the listener: on the database host, run
ss -lntpand confirm the process is bound only to the private address and intended port. - Test an allowed connection: from each approved application host, connect to the private DNS name, expected database, and expected role.
- Verify TLS: confirm the client reports the expected TLS mode, trusted CA, and certificate identity; deliberately test an untrusted CA and wrong hostname.
- Test denial: from a host outside the allow-list, confirm the firewall blocks the port or the database rejects the source without exposing a usable login path.
- Review logs: inspect network-firewall, host-firewall, PostgreSQL or MySQL, and authentication logs for accepted and denied attempts.
- Exercise recovery: restore an off-host backup to a clean instance and run an application-level health check.
Repeat these checks after changing subnets, security groups, certificates, database versions, or application hosts.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSelf-managed server or managed private database?
Self-management gives control over the operating system, database parameters, extensions, and physical or virtual placement. It also leaves patching, monitoring, failover, firewall changes, backup scheduling, and restore testing to your team. A managed service can provide a private address through the provider network and may automate portions of backup and failover, but it introduces provider-specific networking and configuration constraints.
| Decision axis | Self-managed database host | Managed private database |
|---|---|---|
| Host operations | Your team patches the operating system and database, manages monitoring, and operates failover. | The provider operates the service infrastructure; your team still configures access, roles, clients, and recovery expectations. |
| Private connectivity | You design the subnet, routes, security groups, and host firewall. | The provider exposes a private address through a private-service mechanism such as VPC peering; setup is provider-specific. |
| Backup and recovery | You schedule off-host backups and prove restores. | Provider backup and failover features may exist, but retention, export, and restore behavior must be verified for your service. |
| Configuration portability | You control extensions, versions, and filesystem layout. | Supported extensions, parameters, maintenance windows, and export paths are constrained by the service. |
Choose based on operational ownership, private-network integration, backup and failover controls, and how portable your database configuration must remain. A managed endpoint is not automatically public; select the private connectivity option and confirm that no external address is enabled.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When an outbound connector is safer than inbound access
Some analytics or data platforms need to query a private database but cannot join your private network directly. An outbound connector can initiate the connection from inside your network, so the database does not need an inbound Internet rule. Snowflake documents a Data Connectivity Proxy agent that makes one outbound encrypted connection on port 443 and routes requests to private PostgreSQL, MySQL, and similar sources. In that model, the firewall sees outbound traffic, with no inbound listener, public IP, or VPN required for the connector path.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Apply the same least-privilege database role, TLS verification, source restrictions, logging, and backup controls to connector traffic. Confirm whether the connector’s source address is stable enough for a narrow firewall and pg_hba.conf rule.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot the common failure modes
The application times out
Check the route and private DNS first, then the cloud security group and host firewall. Confirm PostgreSQL or MySQL is listening on the private address rather than only on localhost. A timeout usually indicates routing or filtering; it is different from an authentication error.
The server refuses the connection
Inspect the listening socket and configured port. A service bound to 127.0.0.1, the wrong private address, or a different port will refuse connections even when the firewall is open. Reload or restart after changing the bind setting.
PostgreSQL reports “no pg_hba.conf entry”
Match the client’s actual source address, database name, and role to an ordered rule. Add the narrow rule above any broader rule, reload PostgreSQL, and ensure the role has CONNECT privilege.
TLS verification fails
Check that the client trusts the issuing CA, that the certificate is current, and that the hostname in the connection matches the certificate identity. Do not “fix” the problem by disabling verification in production; correct the name, trust store, or certificate chain.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Backups succeed but restores fail
Restore to a clean server using the same major-version compatibility requirements, verify extensions and roles, and test application queries. Check that backup credentials, certificate files, and encrypted-object keys are available to the restore process without granting them broad access.
Operational security checklist
- The database listener is bound to the private interface only.
- Network and host firewalls allow only named application, migration, reporting, and administration sources.
- PostgreSQL rules use exact databases, roles, source CIDRs, ordered matches, and secure methods such as
hostsslwith SCRAM. - TLS is enabled; private-key permissions are restrictive; clients validate the issuing CA and hostname.
- No broad
trustrule or clear-text password rule is exposed on an untrusted network. - Application, migration, reporting, and administration roles are separate and have only required privileges.
- Backups are scheduled, encrypted, off-host, access-controlled, retained, and restore-tested.
- Public reachability, private reachability, denied-source behavior, certificate failures, and logs have all been checked.
The resulting design is straightforward: private routing limits who can reach the server, firewalls limit which hosts can open the port, database rules limit which identities can use it, TLS protects the connection, and tested off-host backups limit the impact of hardware, software, or operator failure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
