Your production database runs on a server behind a firewall. You need to run a query, check a backup, or debug an issue. Normally, this means SSH into the server, run the query from the command line, or set up a VPN to access the database port directly.
Database Access Through CONNECT Mode
With ProxyPass, you configure your database client to use the ProxyPass node as an HTTP CONNECT proxy. Your client opens a tunnel through ProxyPass to the database port on the remote machine. From the client's perspective, it is connecting to the database directly. From the network's perspective, nothing changed — the node still makes only outbound connections.
This works with PostgreSQL, MySQL, MariaDB, SQL Server, MongoDB, Redis — any database that communicates over TCP. The CONNECT proxy tunnels raw TCP bytes, so the database protocol runs unmodified inside the encrypted tunnel.
Scenario: The Cross-Environment Database Check
A development team manages databases across four environments: development, staging, production EU, and production US-East. Each environment runs on a different hosting provider, behind different firewalls, with different network configurations.
Traditionally, the team maintained four VPN profiles — each with its own credentials, certificates, and split-tunnel configuration. Switching between environments meant disconnecting one VPN and connecting another. Every. Single. Time.
With ProxyPass, each environment has a node. The team configures their database client (DBeaver, pgAdmin, DataGrip — whatever they prefer) to use the ProxyPass proxy. They switch between databases by changing the target address in the client. No VPN switching. No credential rotation. No tunnel reconfiguration. Just change the host and connect.
End-to-End Encryption
ProxyPass never sees your queries, your results, or your credentials. The CONNECT tunnel means your database credentials and session data travel encrypted end-to-end between your client and the database server. ProxyPass sees only opaque bytes — it could not read your SQL queries even if it wanted to.
Simpler Than SSH Tunneling
The practical advantage over SSH tunneling is simplicity. You do not need SSH credentials for the remote server. You do not need to set up port forwarding manually for each database. You configure your proxy once in your database client, and every connection goes through ProxyPass automatically.
For teams that manage databases across multiple environments — staging, production, customer-hosted instances — this means one consistent access method. No per-server SSH keys. No VPN profiles per environment. No firewall rules to maintain. Just the proxy configuration pointing to your ProxyPass subdomain, and you reach any database behind any node in your fleet.