Zscaler Cloud Proxy
You set up a zscaler cloud proxy by routing device traffic to cloud edges. Then you link your identity provider to check user logins and apply network rules. Teams often use this setup to replace legacy virtual private networks. Still, admins often grant broad network roles so engineers can do their work. When permissions are too wide, one login gives access to entire server subnets. How a zscaler cloud proxy architecture works A zscaler cloud proxy routes user traffic through distributed clo
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a zscaler cloud proxy by routing device traffic to cloud edges. Then you link your identity provider to check user logins and apply network rules. Teams often use this setup to replace legacy virtual private networks. Still, admins often grant broad network roles so engineers can do their work. When permissions are too wide, one login gives access to entire server subnets.
How a zscaler cloud proxy architecture works
A zscaler cloud proxy routes user traffic through distributed cloud enforcement nodes. You install a client agent on user laptops to forward packets out. You can also set up router tunnels from branch offices to the cloud. When a user requests a resource, the local agent intercepts that traffic first. It sends the packets to the nearest cloud enforcement node for inspection.
Next, the cloud node checks who the user is through your identity provider. It reads the user group and device posture before allowing any network flow. For web traffic, the system decrypts packets and scans for known malware threats. For private apps, a lightweight connector sits inside your private server network. This internal connector builds an outbound tunnel to the cloud edge node. It lets approved users reach internal ports without opening inbound firewall holes. The admin writes rules that match user groups to target network segments.
Planning network roles for engineering teams
Security teams group users by department when they build cloud routing rules. Developers get access to staging subnets, while site reliability engineers reach production hosts. You define each internal app by its host address and port number. Then you assign those app groups to specific identity provider roles. The connector checks that the internal host exists and routes the packets.
This model works well when users only need internal web dashboards. A browser requests a page, the cloud checks the group, and traffic flows. Still, engineering work involves more than viewing internal web pages. Developers run database queries, execute shell commands, and call internal service endpoints. When teams face tight deadlines, admins often group many hosts into one rule. They open wide port ranges so engineers do not get blocked during incidents. Over time, temporary network exceptions become permanent rules that nobody wants to remove.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native network controls leave open
This cloud network model solves the problem of exposed inbound firewall ports. It stops attackers from scanning your public IP addresses from the outside internet. It also links network access to a real user login and device check. You get a clean log of which user opened a network tunnel.
Still, the native setup only decides who can open a network path. Once the tunnel connects, the network tool does not read database queries. An engineer still needs a database password or an SSH key to log in. Teams end up sharing static passwords or storing keys on local laptops. Also, the network layer cannot tell a safe query from a destructive command. If an engineer queries a table with emails or card numbers, raw data flows back. To control individual commands and rewrite sensitive fields, you need deeper runtime controls.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev sits inline in the wire protocol beside those services as an open-source proxy, a sidecar for your Postgres or API. On every query an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human review.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Does a cloud network tunnel replace database passwords?
No, the network tunnel only carries packets from the laptop to the database port. The user still must provide a database username and password to log in.
Can network routing rules block destructive SQL queries?
No, network routing rules only check host addresses, ports, and user groups. They do not inspect SQL statements or block a user from dropping tables.
How does data masking work for database results?
A network tunnel passes all bytes back to the client without changing database rows. Data masking requires a tool that parses query results and rewrites emails or phone numbers.