Zscaler Transparent Proxy
A zscaler transparent proxy forwards outbound traffic through secure tunnels without manual browser settings. You set it up by routing branch firewall traffic or installing an endpoint agent. Many teams use this design to filter web traffic and block bad sites. Still, broad network rules often grant wide reach into internal backend systems. Once a user passes the perimeter check, they can run risky commands unchecked. How a zscaler transparent proxy routes traffic In a standard setup, user de
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
A zscaler transparent proxy forwards outbound traffic through secure tunnels without manual browser settings. You set it up by routing branch firewall traffic or installing an endpoint agent. Many teams use this design to filter web traffic and block bad sites. Still, broad network rules often grant wide reach into internal backend systems. Once a user passes the perimeter check, they can run risky commands unchecked.
How a zscaler transparent proxy routes traffic
In a standard setup, user devices do not know the cloud filter exists. The local router or endpoint agent catches outbound packets at the network layer. It then sends those packets through a tunnel to the nearest cloud node. The cloud service checks the user role and applies web filtering rules. If the rule allows the request, the service forwards the packet out.
Teams also must manage certificates when they inspect encrypted web traffic. You have to push a root certificate to every laptop and server. Devices without a certificate store need special bypass rules to work right. Developers often hit errors when command line tools reject the swapped certificate. Fixing these broken tools takes hours of manual work for the network team.
What network forwarding solves and what it misses
This network model works well for general office web browsing and SaaS apps. It stops users from visiting known bad domains and blocks dangerous file downloads. Network admins get a single place to check web logs across all branches. It also removes the need to manage browser config files on every device.
Still, network routing only decides who can open a path to a host. It does not read or control database queries or server commands in flight. An engineer with network clearance still logs into a database using shared keys. Once inside, that engineer can read raw emails, phone numbers, or card numbers. The network tunnel cannot rewrite matched fields in query results or block bad deletes.
Why engineering teams need command-level controls
Modern engineering workflows need deeper checks than IP and port rules can provide. When developers debug production systems, they run live queries and shell scripts. A network tunnel sees an encrypted stream going to a database port. It cannot tell a safe read query from a command that drops tables.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Relying only on network tunnels forces teams to hand out static database passwords. Those keys often live in plain text files on developer laptops for months. If an attacker steals a laptop, they inherit the open network path too. Real safety requires checking every single command and masking data before it returns.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
How does transparent mode differ from explicit mode?
Transparent mode routes traffic through tunnels without changing browser or app settings. Explicit mode requires you to point each app to a specific host address.
Why do developer CLI tools fail under TLS inspection?
Many command line tools use their own certificate lists instead of system stores. They drop traffic when they see an unknown root certificate on the network.
Can a network tunnel mask sensitive fields inside a database query?
No, a network tunnel only routes packets between endpoints based on IP rules. It does not parse database protocols or rewrite emails and card numbers in results.
Teams that document these role rules and review logs each month catch config drift early. Clear ownership for each role keeps live systems simple to run and easy to audit across the whole team.