Tutorial: Secure Database Access Without Exposing Your Database to the Internet⁠

Overview⁠

A publicly accessible database port is one of the most common attack surfaces for production environments. Attackers continuously scan the internet for exposed PostgreSQL (5432), MySQL (3306), and MongoDB (27017) ports, looking for misconfigurations, weak credentials, or leaked connection strings.

Traditional approaches reduce risk by combining IP allowlists, SSL enforcement, secrets management, and database authentication. While these are all recommended security practices, the database service remains reachable from the public internet.

OpenVPN Access Server takes a different approach by providing VPN-only access to your database. Rather than protecting an exposed database port, Access Server removes it from the public internet entirely. Only authenticated VPN users can attempt a connection, and you can further restrict access to specific users or groups with Access Server's access controls.

This tutorial covers two common deployment scenarios:

Scenario 1: Secure a self-hosted PostgreSQL, MySQL, or MongoDB database running on a private network.
Scenario 2: Secure a managed database service, such as Amazon RDS, MongoDB Atlas, or Google Cloud SQL, by configuring an allowlist that permits connections only from Access Server's static egress IP.

Prerequisites⁠

Access Server installed.
An Access Server user group created called db-access.
OpenVPN Connect installed on developer devices.
A database client appropriate for your database platform.

For Scenario 1, you'll also need:

A self-hosted PostgreSQL, MySQL, or MongoDB server on the same private network as Access Server, or reachable through subnet routing.

For Scenario 2, you'll also need:

A managed database service that supports IP allowlists, such as Amazon RDS, MongoDB Atlas, or Google Cloud SQL.

Example environment⁠

Component	Example value
Access Server public IP	`203.0.113.5`
Access Server private IP	`192.0.2.10`
VPN client subnet	`198.51.100.0/24`
Database host	`192.0.2.20`
PostgreSQL	TCP 5432
MySQL	TCP 3306
MongoDB	TCP 27017
Authorized group	db-access

Scenario 1: Secure a self-hosted database on a private network⁠

Use this scenario when you host your own PostgreSQL, MySQL, or MongoDB database on a private network that's reachable from Access Server.

The goal is to remove the database port from the public internet so it's accessible only through an authenticated VPN connection.

Configure the database host so the database service isn't publicly accessible.

Review your firewall or cloud security group protecting the database host.
Remove any inbound rules that allow public access to your database port.
Configure the following inbound rules:
- Allow SSH (TCP 22) only from your managed network.
- Allow the database port from the Access Server private IP. For example, 192.0.2.10.
Deny other inbound traffic that isn't required by the database host.

For example, using ufw:

# Allow SSH from the management network
ufw allow from 203.0.113.0/24 to any port 22

# Allow PostgreSQL from Access Server
ufw allow from 192.0.2.10 to any port 5432

# Deny all other inbound traffic
ufw default deny incoming

ufw enable

Configure Access Server so VPN clients can reach the private network where the database resides.

For most deployments, use NAT. Access Server translates VPN client traffic to its private IP address before forwarding it to the database. Because the database responds directly to Access Server, you don't need to configure a return route for the VPN client subnet.

Sign in to the Admin Web UI.
Select Access Controls.
Select the Global Access Rules tab.
Under IP Addresses and Subnets, add the database subnet. For example: 192.0.2.0/24.
Set the routing mode to NAT.
Select Save and Restart.

Instead of allowing every VPN user to reach the database, create an access rule that permits only members of the db-access group.

Sign in to the Admin Web UI.
Select Groups.
Select the db-access group.
Select the Access Rules tab.
Select New Access Rule.
Configure the rule:
Setting
Example value
Destination
192.0.2.20/32
Protocol
TCP
Port
5432 (PostgreSQL), 3306 (MySQL), or 27017 (MongoDB)
Routing mode
NAT
Select Save rule and Restart.
Note
Only users who are members of the db-access group can connect to the database. Other VPN users can't reach the database unless another access rule explicitly grants them access.

Setting	Example value
Destination	`192.0.2.20/32`
Protocol	TCP
Port	5432 (PostgreSQL), 3306 (MySQL), or 27017 (MongoDB)
Routing mode	NAT

Create a VPN user with access to the database, then verify the connection..

Create the user⁠

Sign in to the Admin Web UI.
Select Users.
Select Add New User or select an existing user.
Add the user to the db-access group.
For a new user, select Reset Password and enter a new password.
Tip
Ensure the password meets password requirements.
Select Save and Restart.
Send the user the following information:
- The Client Web UI URL.
- Their username.
- Their password or temporary password for a new user.

Get connected⁠

The end user can download OpenVPN Connect for Windows, macOS, iOS, and Android directly from the Client Web UI. For Linux, see Tutorial: Connect to Access Server with Linux.

Sign in to the Client Web UI using the credentials provided by your administrator.
Download OpenVPN Connect with a bundled connection profile for your operating system.
Install OpenVPN Connect.
Launch OpenVPN Connect and connect to the VPN with the included connection profile.

Connect to the database using the appropriate client.

For PostgreSQL:

psql -h 192.0.2.20 -U your_db_user -d your_database

For MySQL:
```
mysql -h 192.0.2.20 -u your_db_user -p
```
For MongoDB:
```
mongosh "mongodb://192.0.2.20:27017"
```

Disconnect the VPN and repeat the connection attempt.

Expected result:

A user assigned to the db-access group can connect to the database while connected to the VPN.
After disconnecting from the VPN, the database is no longer reachable because the database port isn't publicly accessible.

Scenario 2: Secure a managed database service with an IP allowlist⁠

Use this scenario when your database is hosted by a managed service such as Amazon RDS, MongoDB Atlas, or Google Cloud SQL.

Unlike a self-hosted database, a managed database service can't usually be placed entirely on your private network. Instead, you can configure an allowlist so the database accepts connections only from Access Server's public IP address (static egress IP). Developers connect through the VPN, and all database traffic exits through Access Server using its public IP address.

Your managed database service will allow connections only from this IP address. Use this IP address to configure the managed database service's allowlist in the next step.

Admin Web UI⁠

Sign in to the Admin Web UI.
On the Status page, locate the Server address under Server Details.
Record the IP address.

Command line⁠

You can also retrieve the public IP address from the Access Server console.

Connect to the console and get root privileges.
Run:
```
sacli ip
```
- Example output:
```
203.0.113.5
```
Record this IP address.

Configure your managed database service to accept connections only from Access Server's public IP address.

For example, in Amazon RDS, update the database's associated VPC security group so the database port accepts connections only from Access Server's public IP address.

Configure an inbound rule similar to the following:

Setting	Value
Port	Your database port (for example, PostgreSQL 5432, MySQL 3306, or MongoDB 27017)
Allowed source	`203.0.113.5/32` (Access Server's public IP)

Remove any existing rules that allow unrestricted public access (such as 0.0.0.0/0).

Configure Access Server so that database traffic exits using its public IP address.

Sign in to the Admin Web UI.
Select Access Controls.
Create or edit an access rule for the managed database endpoint.
Configure:
Setting
Example value
Destination
Managed database IP address or subnet
Protocol
TCP
Port
Database port
Routing mode
NAT
Select Save and Restart,
Important
NAT routing causes outbound database traffic to use Access Server's public IP address, allowing it to match the database service's configured allowlist.

Setting	Example value
Destination	Managed database IP address or subnet
Protocol	TCP
Port	Database port
Routing mode	NAT

Instead of allowing every VPN user to reach the database, create an access rule that permits only members of the db-access group.

Sign in to the Admin Web UI.
Select Groups.
Select the db-access group.
Select the Access Rules tab.
Select New Access Rule.
Configure the rule:
Setting
Example value
Destination
Managed database endpoint
Protocol
TCP
Port
Database port
Routing mode
NAT
Select Save rule and Restart.
Note
Only users who are members of the db-access group can connect to the database. Other VPN users can't reach the database unless another access rule explicitly grants them access.

Setting	Example value
Destination	Managed database endpoint
Protocol	TCP
Port	Database port
Routing mode	NAT

Create a VPN user with access to the database, then verify the connection..

Create the user⁠

Sign in to the Admin Web UI.
Select Users.
Select Add New User or select an existing user.
Add the user to the db-access group.
For a new user, select Reset Password and enter a new password.
Tip
Ensure the password meets password requirements.
Select Save and Restart.
Send the user the following information:
- The Client Web UI URL.
- Their username.
- Their password or temporary password for a new user.

Get connected⁠

The end user can download OpenVPN Connect for Windows, macOS, iOS, and Android directly from the Client Web UI. For Linux, see Tutorial: Connect to Access Server with Linux.

Sign in to the Client Web UI using the credentials provided by your administrator.
Download OpenVPN Connect with a bundled connection profile for your operating system.
Install OpenVPN Connect.
Launch OpenVPN Connect and connect to the VPN with the included connection profile.
Connect to your managed database using your preferred database client.
Disconnect the VPN and repeat the connection attempt.

Expected result:

A user assigned to the db-access group can connect to the database while connected to the VPN.
After disconnecting from the VPN, the database is no longer reachable because the database port isn't publicly accessible.

Results⁠

Before	After
Database port publicly reachable.	Database accepts connections only from Access Server's public IP address.
Database access based only on credentials.	Database access requires valid credentials and an authenticated VPN session.
Any source matching the allowlist can connect	Only members of the db-access group can reach the database through Access Server
Developers manage changing client IP addresses	Developers connect through a consistent static egress IP

Tutorial: Secure Database Access Without Exposing Your Database to the Internet⁠

Overview⁠

Prerequisites⁠

Example environment⁠

Scenario 1: Secure a self-hosted database on a private network⁠

Scenario 2: Secure a managed database service with an IP allowlist⁠

Results⁠

Related resources⁠

Was this information helpful?