Common use case

Give developers direct access to a private database

Let developers keep their normal database tools and connect to the real private endpoint without publishing the database.

Short answer

Install the full client and run wireztna connect. Then point the database tool at its private hostname or IP, not localhost.

The problem

Database access often becomes the reason for distributing a broad VPN profile. That profile may also expose servers, caches, consoles, and unrelated databases.

Choose and scope the connection model

Authorize the developer's group for the database publisher. The client installs WireGuard, routes, and split DNS so existing tools reach the private address directly.

  1. 1Deploy a publisher that can reach the database and expose its private CIDR.
  2. 2Assign the developer through a group authorized for that publisher.
  3. 3Add an effective restricted /32 and TCP-port rule when the client must reach only that database endpoint.
  4. 4Run wireztna connect and open the private hostname or IP with an individual database account.

Example access flow

Consumer

Developer laptop

Client command

wireztna connect

Private destination

db.staging.internal:5432

Authorization boundary

Group-authorized CIDRs; optional effective /32 and TCP 5432 rule

When this pattern fits

  • A developer uses psql, DBeaver, DataGrip, or another native database tool.
  • The device can run the full client and create a WireGuard interface.
  • The database must remain on a private subnet.
  • Database accounts and roles are managed separately from network access.

Security boundary and limitations

  • Without an effective restricted policy, the client can route the publisher CIDRs authorized through the developer's groups.
  • published_apps does not enforce a deny boundary for other traffic inside those CIDRs.
  • PostgreSQL or MySQL still controls authentication, TLS, roles, query permissions, and auditing.

Frequently asked questions

Do developers connect to localhost?+

No. The full client lets them use the database's private hostname or IP directly. Localhost belongs to the separate wzctl flow.

Can access be limited to one database port?+

Yes. Use a restricted group-publisher policy with an effective AccessRule for the database /32 and TCP port.

When should I use wzctl instead?+

Use wzctl when a process needs one fixed local TCP endpoint and should not receive private DNS or network routes.

Put this pattern into practice

→Read the Quick Start →Understand the architecture →Discuss your use case
← All use cases