# Performance of AWS RDS \<-\> Wireguard bastion \<-\> Fly Private Networking **URL:** \ **Category:** General\ **Created:** [August 25, 2021, 5:15pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322 "2021-08-25T17:15:34Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![ajbouh](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ajbouh/32/1771_2.png) [@ajbouh](https://community.fly.io/u/ajbouh)\ **Post date:** [August 25, 2021, 5:15pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/1 "2021-08-25T17:15:34Z")
I’m trying to decide if I should be deploying my Hasura instances (and possibly Postgres read replicas) via fly or via AWS. I’d personally prefer fly, but then I need to sort out how fly gets access to my AWS VPC where my RDS instance is running. Based on my research that _seems_ like it’s via a [Wireguard bastion host](https://github.com/fly-apps/rds-connector) that I deploy in AWS. Adding a hop like this seems like it would be a bottleneck (for both bandwidth and latency) as well as a single point of failure. But perhaps that’s not a problem in practice? Does anyone here have real world experiences with a setup like this? How has it turned out? ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [August 25, 2021, 5:19pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/2 "2021-08-25T17:19:30Z")
This will work great in some AWS regions, and less great in others. In us-east-1, for example, it should work well because we’re \<1ms away from AWS. In other regions latency is higher. The gateway is definitely another moving part to manage, though. As much as I want you to use Fly for all the things, I would _probably_ run Hasura on the same infrastructure as my database. ---
**Author:** ![ajbouh](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ajbouh/32/1771_2.png) [@ajbouh](https://community.fly.io/u/ajbouh)\ **Post date:** [August 25, 2021, 5:32pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/3 "2021-08-25T17:32:12Z")
Well once postgres is dialed in (and closer to fully managed), I’ll experiment with moving this entire part of the stack over to fly. 🙂 ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [August 26, 2021, 1:53am UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/4 "2021-08-26T01:53:35Z")
Soon! We’re working on Postgres full time now, there have been vast improvements in the last couple of weeks. ---
**Author:** ![nate-dwell](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nate-dwell/32/4686_2.png) [@nate-dwell](https://community.fly.io/u/nate-dwell)\ **Post date:** [August 22, 2022, 4:08pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/5 "2022-08-22T16:08:45Z")
@ajbouh did you ever get this working? If so, what kind of latency do you experience? I’m trying to do similar in [Fly.io + RDS & Elasticache - #5 by nate-dwell](https://community.fly.io/t/fly-io-rds-elasticache/6465/5). ---
**Author:** ![ajbouh](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ajbouh/32/1771_2.png) [@ajbouh](https://community.fly.io/u/ajbouh)\ **Post date:** [August 25, 2022, 11:12pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/6 "2022-08-25T23:12:09Z")
No, sadly. I decided to keep things that needed direct access to RDS inside of AWS. ---
**Author:** ![joevandyk](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/joevandyk/32/6776_2.png) [@joevandyk](https://community.fly.io/u/joevandyk)\ **Post date:** [November 3, 2022, 10:14pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/7 "2022-11-03T22:14:46Z")
@kurt which fly region is 1ms away from AWS? ---
**Author:** ![rugwiro](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/rugwiro/32/49239_2.png) [@rugwiro](https://community.fly.io/u/rugwiro)\ **Post date:** [November 4, 2022, 12:04pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/8 "2022-11-04T12:04:16Z")
That would depend on the AWS region, for example, our `iad` region is the closest to us-east-1 since it’s all in Virginia. ---
**Author:** ![sb8244](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/sb8244/32/10925_2.png) [@sb8244](https://community.fly.io/u/sb8244)\ **Post date:** [November 24, 2022, 3:58am UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/9 "2022-11-24T03:58:41Z")
I just set up wireguard using the config from [GitHub - fly-apps/rds-connector: Trivial Terraform example for a WireGuard peer to RDS](https://github.com/fly-apps/rds-connector). My app is in fly:iad and I’m in us-east-1 ```auto iex> :timer.tc(fn -> Super.Repo.query("SELECT 1") end) |> elem(0) |> Kernel./(1_000) 7.259 ``` I’m seeing ~7ms total round trip for my query. Originally I accidentally created everything in US Ohio and round trip was 30ms. ---
**Author:** ![acr13](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/acr13/32/2690_2.png) [@acr13](https://community.fly.io/u/acr13)\ **Post date:** [March 17, 2023, 8:42pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/10 "2023-03-17T20:42:57Z")
Hey @sb8244 We’re trying to do the same, but I’m unable to connect my fly app to the ec2 peer… what ip / hostname are you using? My fly app → peer connection string looks something like: ```auto DATABASE_URL=postgres://:@._peer.internal:5432 ``` Does this look similar to what you used? I can connect using the above string from my local machine in the wireguard VPN, but not from a fly app 🤔 ---
**Author:** ![sb8244](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/sb8244/32/10925_2.png) [@sb8244](https://community.fly.io/u/sb8244)\ **Post date:** [March 17, 2023, 8:57pm UTC](https://community.fly.io/t/performance-of-aws-rds-wireguard-bastion-fly-private-networking/2322/11 "2023-03-17T20:57:01Z")
My connect string looks like: `postgres://USER:PASS@pgbouncer._peer.internal:6432/db_name`. The pgbouncer name is based on the wireguard config that I setup for ec2 to use. I chose to use 6432 but I think the default would be 5432. I picked 6 to make it very clear that it’s not a normal postgres connection. When you use wireguard, you’re effectively operating on a private network. So your app will never reference an IP or external DNS name.