What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Keep the Rails application and PostgreSQL database on private addresses, expose only the public edge or reverse proxy, and give operators a separate path through a tightly restricted bastion. For administration, use an SSH local forward bound to 127.0.0.1, so a database client on your workstation reaches the private service without making PostgreSQL public.
This design limits network paths, but an SSH tunnel is not automatically end-to-end encryption for every hop. If the bastion forwards to a different database host, protect the bastion-to-database leg with database TLS, a second SSH hop, or an authenticated encrypted private network.
Start with the three security zones
A three-tier deployment separates the public edge, the Rails application, and the database. The separation matters because each tier has a different reason to accept traffic and a different compromise impact.
| Tier | Typical placement | Permitted inbound traffic | What should not be exposed |
|---|---|---|---|
| Edge | Public subnet, load balancer, or reverse proxy | HTTP/HTTPS from the intended users or upstream network | Administrative ports, Rails internals, and PostgreSQL |
| Rails application | Private subnet or provider private network | Only the edge-to-application port, such as the application listener | Direct public access and database administration ports |
| PostgreSQL | Private subnet or managed private service | PostgreSQL from the application tier and narrowly authorized operator access | Direct Internet connections |
The normal request path is edge to Rails to PostgreSQL. An operator path is different: workstation to bastion (or a provider SSH endpoint), then a forwarded connection to the private database or internal service. Do not treat the operator tunnel as evidence that the Rails application itself can authenticate or reach the database; test those paths independently.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Allow only the flows the application needs
- Permit the edge security group, firewall rule, or private-network policy to reach only the Rails listener.
- Permit the Rails hosts or service identity to reach PostgreSQL on its database port, normally TCP 5432.
- Permit operator SSH only to the bastion or approved provider endpoint, not to the database’s public address.
- Restrict the bastion’s forwarding destinations to the database host and port required for the maintenance task.
- Deny unsolicited inbound traffic to the application and database tiers, and review outbound rules where your platform supports them.
What an SSH tunnel does
PostgreSQL’s documentation describes SSH as a way to encrypt the network connection between a client and a PostgreSQL server. A local forward has this form:
ssh -L LOCAL_ADDRESS:LOCAL_PORT:REMOTE_HOST:REMOTE_PORT user@SSH_SERVERYour client connects to LOCAL_ADDRESS:LOCAL_PORT. The SSH server then opens a connection to REMOTE_HOST:REMOTE_PORT from its own network position. That last detail is crucial: localhost in the remote target means the SSH server itself, not your workstation.
A safe operator command
ssh -N -T -o ExitOnForwardFailure=yes
-L 127.0.0.1:63333:127.0.0.1:5432
deploy@bastion.example-Lcreates a local port forward.127.0.0.1:63333is an arbitrary, unused port on your workstation. Binding it to loopback prevents other machines on your local network from using the listener.127.0.0.1:5432is resolved from the bastion’s point of view. This form is correct when PostgreSQL is on the bastion itself or is reachable there as loopback.-Nrequests forwarding only and does not start a remote shell.-Tdisables pseudo-terminal allocation.-o ExitOnForwardFailure=yesmakes SSH exit instead of leaving you with a session whose requested forward failed.
With the tunnel running, point a PostgreSQL client at the local endpoint:
psql -h 127.0.0.1 -p 63333 postgresKeep the terminal session open while the administrative task runs. Close it as soon as the task is complete.
Build the network and access path
1. Map addresses, ports, and trust boundaries
Record the edge hostname, Rails listener, private database hostname, database name, and the exact operator workflow before changing firewall rules. Decide whether the bastion is the database host, a host that can route to the database, or a provider-managed SSH endpoint. The answer determines the remote target in the -L argument and the encryption boundary.
2. Put Rails and PostgreSQL on private addresses
Remove public database listeners and public security-group rules. The Rails service should resolve the database through private DNS or a private address. If your hosting platform offers private networking, use its internal service name rather than a public hostname.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Some managed platforms make PostgreSQL private by default and expose a public TCP proxy only when public access is enabled. Leave that public option disabled unless a documented, temporary exception is unavoidable. A private service path and an operator SSH tunnel solve different problems: the first carries application traffic, while the second gives a human a controlled maintenance route.
3. Create a narrow bastion or provider SSH endpoint
Place the bastion where it can reach the database’s private address but does not have broad access to every internal service. Its inbound rule should allow SSH only from approved operator networks, a VPN, or an equivalent controlled source. Keep the bastion patched and monitored as production infrastructure; it becomes a security boundary, not a disposable jump box.
4. Use separate operator identities
Issue individual SSH keys or short-lived credentials rather than sharing one account. Remove unused keys, record who owns each active key, and review authentication and forwarding logs. Use an account intended for tunnel work, and disable interactive shells for that account when the platform and your operational procedures support it.
5. Restrict forwarding on the SSH server
OpenSSH can limit forwarding behavior in its server configuration or per-key options. A starting point for a tunnel-only account is:
Free tools Windows power users keep installed
One-click scans. No signup required.
AllowTcpForwarding local
PasswordAuthentication no
X11Forwarding no
AllowAgentForwarding noUse a destination restriction such as PermitOpen or an equivalent per-key policy to allow only the required private database host and port. For example, a bastion that forwards to db.internal.example:5432 should not also permit arbitrary ports on unrelated hosts. Configuration names and available controls vary by provider, so verify the effective server configuration and test a denied destination.
6. Start the local forward
If the database is reachable from the bastion as db.internal.example, use:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
ssh -N -T -o ExitOnForwardFailure=yes
-L 127.0.0.1:63333:db.internal.example:5432
deploy@bastion.exampleThe local client still uses 127.0.0.1:63333. Do not change the local host to the database’s private name: that would bypass the tunnel and usually fail from an outside workstation.
7. Connect without moving secrets into the command line
Use the normal PostgreSQL secret store, password prompt, or your organization’s approved credential helper. Do not paste a database password into a shell command, commit it to a Rails repository, or place it in a shared terminal transcript. Rails credentials and environment variables should be supplied through the deployment secret manager, with access limited to the application identity.
8. Tear down temporary access
Terminate the SSH session when the task ends, remove temporary firewall or key exceptions, and expire short-lived credentials. A tunnel that remains open is an active route into a private service, even when no query is currently running.
Understand the encryption boundary
Consider this common forwarding pattern:
ssh -L 127.0.0.1:63333:db.foo.com:5432 joe@shell.foo.comThe workstation-to-shell.foo.com segment is protected by SSH. The SSH server then makes a separate TCP connection from shell.foo.com to db.foo.com. PostgreSQL’s tunnel guidance explicitly warns that this second segment is not encrypted by the SSH tunnel itself.
Ways to protect the second hop
- Terminate SSH on the database host. Forward to loopback on the database machine when that is operationally acceptable.
- Use database TLS. Configure PostgreSQL and the client to verify the database certificate while the tunnel carries the traffic to the private host.
- Use a second protected hop. Chain tunnels only when the additional operational complexity is understood and audited.
- Use an authenticated encrypted private network. A provider’s private network may carry east-west traffic through encrypted WireGuard tunnels and internal DNS, keeping packets off the public Internet.
Private-network encryption protects transport and routing between services; it does not replace PostgreSQL authentication, Rails authorization, secret management, or least-privilege database roles.
Keep Rails on its normal private connection
The production Rails process should connect directly to the private database service, not through an operator’s workstation tunnel. Configure its database host and port to the private DNS name and PostgreSQL port, and provide the username, password, and TLS settings through the deployment secret manager.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
A local tunnel is appropriate for a developer or administrator using psql, a migration tool, or a graphical database client. It is not a substitute for the application’s network policy. If an application can connect only when an operator’s laptop is online, the production network design is incomplete.
Separate database privileges
Create a Rails runtime role with only the privileges the application requires. Use a separate maintenance role for schema changes or incident response, and do not reuse the owner or superuser account in the application configuration. Restrict each role to the intended database and schemas, and rotate credentials through the same secret-management process as other production secrets.
Protect Rails secrets and connection details
- Keep
database.ymltemplates free of real passwords and private keys. - Inject secrets at deploy or runtime rather than storing them in source control.
- Ensure logs do not print full database URLs, passwords, or tunnel commands containing credentials.
- Use a separate local configuration for a tunnel endpoint so a developer cannot accidentally deploy
127.0.0.1:63333as the production database host.
Private networking for east-west traffic
A managed private-network implementation can provide encrypted service-to-service transport, internal DNS, and environment-level isolation. Railway, for example, documents encrypted WireGuard tunnels and traffic that remains inside its infrastructure, with TCP database traffic supported. That model is useful for the edge-to-Rails and Rails-to-PostgreSQL paths, while SSH remains an auditable operator access mechanism.
Check the provider’s actual routing and isolation model before relying on it. Confirm which environments can resolve one another, whether private addresses change, which ports are supported, and how access logs are retained. Encryption in the provider network does not authorize every service to query every database; preserve firewall rules and database grants.
Provider SSH workflows
Some platforms expose an SSH endpoint that can reach a service’s private network. Their documented pattern is equivalent to:
ssh -N -L 8080:127.0.0.1:8080 user@provider-endpointThe provider may limit forwarding to a container loopback address and the project’s private network. If a platform supplies a command such as connect --ssh with a tunnel-only option, use the generated connection details for psql or a GUI client and leave the tunnel process running for the duration of the session. Verify the endpoint’s destination restrictions and logging rather than assuming provider SSH has unrestricted access.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Test the two paths independently
Test the Rails-to-database path
- From an application host or an approved diagnostic job in the private network, resolve the database’s private name.
- Check that TCP 5432 is reachable from the Rails tier and not from the public Internet.
- Authenticate with the Rails runtime role using the normal secret source.
- Run a harmless query and confirm that application logs do not expose credentials.
Test the operator tunnel
- Choose an unused high local port, such as 63333.
- Start SSH with
ExitOnForwardFailure=yesand the loopback bind. - Connect with
psql -h 127.0.0.1 -p 63333or the equivalent GUI settings. - Confirm the session reaches the intended database and role.
- Stop the tunnel and verify that the local port no longer accepts connections.
A successful operator tunnel proves that the bastion can forward traffic and that your operator identity is authorized. It does not prove that Rails has the right database grants, that the edge can reach Rails, or that the bastion-to-database hop has encryption.
Troubleshoot common failures
| Symptom | Likely cause | Action |
|---|---|---|
bind: Address already in use |
The chosen local port is occupied. | Select another high local port and change the client port to match. |
| SSH exits immediately with forwarding failure | The destination is denied, unreachable, or the local listener cannot bind. | Read the SSH error, verify the bastion’s route and PermitOpen policy, and confirm the local port is free. |
SSH stays connected but psql cannot connect |
The client is using the wrong host or port, or PostgreSQL is not listening at the remote target. | Use 127.0.0.1 and the local forwarded port; then test the remote target from the bastion. |
| Connection reaches PostgreSQL but authentication fails | The role, database name, password, or pg_hba.conf rule is wrong. |
Fix PostgreSQL authorization separately; do not broaden network access to mask a credential error. |
| Rails works from a shell but not in production | Rails is resolving a public or incorrect host, or its runtime secret differs from the test secret. | Inspect the deployed environment and private DNS resolution, then test using the Rails runtime role. |
| Traffic appears unencrypted after the bastion | The tunnel ends at the bastion while the database is on another host. | Add database TLS, a second protected hop, or an authenticated encrypted private network. |
| Other computers can use the tunnel | The local forward was bound to a LAN address or wildcard. | Bind explicitly to 127.0.0.1 and restart the tunnel. |
Compare designs before choosing one
| Design | Public exposure | Encryption coverage | Identity and audit | Operational trade-off |
|---|---|---|---|---|
| Direct public PostgreSQL | Database is Internet-reachable | Requires separately configured database TLS; no SSH boundary | Database logs only unless additional controls exist | Simple client connectivity, highest exposure and weakest network isolation |
| Public edge with private Rails and database | Edge only | Depends on private-network or TLS configuration for each internal hop | Application and platform identities | Good default for application traffic; operators still need a maintenance path |
| Bastion with local SSH forwarding | Bastion SSH only | Workstation-to-bastion is encrypted; protect any later hop separately | Per-operator SSH keys, forwarding logs, and database audit logs | Strong operator control, but requires bastion maintenance and careful destination restrictions |
| Provider private network plus provider SSH endpoint | Edge and approved SSH endpoint | Private east-west encryption depends on provider implementation; verify every hop | Provider access records plus database and application logs | Less infrastructure to operate, with platform-specific limits and failure modes |
Evaluate each option on the same questions: Is the database publicly reachable? Is every network hop encrypted or otherwise protected? How are identities issued, rotated, and revoked? Which forwarding destinations are allowed? Can you audit and alert on access? What happens to application and maintenance work when the bastion or tunnel is unavailable?
Recommended Free Tools
Operational checklist
- Expose only the edge tier; keep Rails and PostgreSQL on private addresses.
- Document the exact edge-to-Rails, Rails-to-PostgreSQL, and operator-to-bastion flows.
- Use a dedicated bastion or provider SSH endpoint with narrow reachability.
- Assign individual operator identities, remove unused keys, and review logs.
- Disable interactive shells and agent or X11 forwarding for tunnel-only accounts where supported.
- Bind local forwards to
127.0.0.1and choose an unused high port. - Use
ExitOnForwardFailure=yesso a failed forward cannot look successful. - Restrict SSH forwarding destinations and database roles to the minimum required.
- Keep Rails secrets and PostgreSQL credentials in the approved secret store, not source control or shell history.
- Test application connectivity separately from operator access.
- Close temporary tunnels and expire or rotate maintenance access immediately after use.
Sources and documented guidance
The PostgreSQL documentation, “Secure TCP/IP Connections with SSH Tunnels,” demonstrates local forwarding with ssh -L 63333:localhost:5432 joe@foo.com and the corresponding psql -h localhost -p 63333 postgres command. It also explains that the remote target is reached from the SSH server and warns about an unencrypted second hop.
Oracle Cloud Infrastructure’s Bastion overview defines port forwarding as a secure connection between a client port and a target port and describes carrying protocols such as MySQL and RDP through that path. The same principle applies to a narrowly permitted PostgreSQL forwarding rule.
Railway’s private-networking documentation describes encrypted WireGuard tunnels, internal DNS, and traffic that stays within the provider infrastructure. Its connection guidance documents SSH-based tunnel workflows and tunnel-only connection details for database clients. Treat those platform behaviors as implementation-specific and verify the current limits in your account.
