Where Do I Put ProxySQL?

In this blog post, we’ll look at how to deploy ProxySQL.

ProxySQL is a high-performance proxy, currently for MySQL and its forks (like Percona Server for MySQL and MariaDB). It acts as an intermediary for client requests seeking resources from the database. It was created for DBAs by René Cannaò, as a means of solving complex replication topology issues. When bringing up ProxySQL with my clients, I always get questions about where it fits into the architecture. This post should clarify that.

Before continuing, you might want to know why you should use this software. The features that are of interest include:

  • MySQL firewall
  • Connection pooling
  • Shard lookup and automated routing
  • Ability to read/write split
  • Automatically switch to another master in case of active master failure
  • Query cache
  • Performance metrics
  • Other neat features!

Initial Configuration

In general, you install it on nodes that do not have a running MySQL database. You manage it via the MySQL command line on another port, usually 6032. Once it is started the configuration in /etc is not used, and you do everything within the CLI. The backend database is actually SQLite, and the db file is stored in /var/lib/proxysql.

There are many guides out there on initializing and installing it, so I won’t cover those details here. It can be as simple as:

ProxySQL Architecture

While most first think to install ProxySQL on a standalone node between the application and database, this has the potential to affect query performance due to the additional latency from network hops.



To have minimal impact on performance (and avoid the additional network hop), many recommend installing ProxySQL on the application servers. The application then connects to ProxySQL (acting as a MySQL server) on localhost, using Unix Domain Socket, and avoiding extra latency. It would then use its routing rules to reach out and talk to the actual MySQL servers with its own connection pooling. The application doesn’t have any idea what happens beyond its connection to ProxySQL.


Reducing Your Network Attack Surface

Another consideration is reducing your network attack surface. This means attempting to control all of the possible vulnerabilities in your network’s hardware and software that are accessible to unauthenticated users.

Percona generally suggests that you put a ProxySQL instance on each application host, like in the second image above. This suggestion is certainly valid for reducing latency in your database environment (by limiting network jumps). But while this is good for performance, it can be bad for security.

Every instance must be able to talk to:

  • Every master
  • Every slave

As you can imagine, this is a security nightmare. With every instance, you have x many more connections spanning your network. That’s x many more connections an attacker might exploit.

Instead, it can be better to have one or more ProxySQL instances that are between your application and MySQL servers (like the first image above). This provides a reasonable DMZ-type setup that prevents opening too many connections across the network.

That said, both architectures are valid production configurations – depending on your requirements.

Share this post

Comments (7)

  • Emily Ikuta

    Question on facebook from Anthony Affee “Do you have a good HA setup for ProxySQL yet? I wish it had a native solution instead of the suggestions I have seen before.”

    October 10, 2017 at 4:15 pm
    • Manjot Singh

      Right now keepalived etc are the best way to make it HA.

      October 10, 2017 at 4:18 pm
  • Paul Dixon

    Proxysql now supports clustering.

    November 30, 2017 at 9:07 am
    • harery

      can you explain how to make the application layer talking proxysql cluster ?

      January 4, 2018 at 4:37 pm
  • abdullah

    Hi Manjot, Is proxysql support in windows ??

    April 6, 2018 at 2:50 pm
  • Sergey Danilov (@danxee)

    Concerning security-related issues,
    If you put everything inside a private LAN (just create a VLAN-tagged network between your servers), the connections between ProxySQL and MySQL instances will be hidden from the outside world. So the picture #2 with all connections over VLAN will do the job.

    December 18, 2018 at 5:08 am

Comments are closed.

Use Percona's Technical Forum to ask any follow-up questions on this blog topic.