Connectivity to your sources

Teramot offers three ways to reach a source system. The choice depends on where the system is and on your organization’s network policies.

In all cases, Teramot initiates the connection to the source and only reads data.

IPsec private network

Teramot operates its own IPsec gateway that establishes a site-to-site VPN with your firewall or VPN concentrator. It is the recommended way to connect systems that live on a private network.

    flowchart LR
    subgraph Teramot["Teramot"]
        W[Extractors] -->|mTLS| P[Connection proxy]
        P --> G[IPsec gateway<br/>Fixed public IP]
    end
    subgraph Cliente["Customer network"]
        F[Firewall / VPN] --> DB[(Source system)]
    end
    G <-->|IKEv2 / IPsec| F
  

How it works

• Each customer connection runs isolated in its own network space within the gateway. One customer’s traffic cannot cross with another’s, even if both use the same IP ranges.
• Extractors do not see your internal addresses. They reach the source through a proxy authenticated with mutual TLS, using an opaque reference to the connection.
• For its side of the tunnel, Teramot assigns a /29 block from the 100.64.0.0/10 range (RFC 6598), which does not collide with common private networks.
• If needed, your internal DNS resolution can be configured on each connection.

What each party provides

Cryptographic parameters

IKEv1, 3DES, DES, SHA-1, MD5, and MODP-1024 are not accepted. The gateway only accepts IKE traffic (UDP 500 and 4500) from the public IPs that each customer declared.

Enablement

Private connections are enabled per workspace. Once enabled, an admin creates and manages them from the application.

SSH tunnel

1. Teramot generates a 4096-bit RSA key pair per workspace.
2. You install the public key on your bastion server, under a dedicated user.
3. Teramot opens an SSH tunnel to the bastion and, from there, connects to the source system on the internal network.

The private key never leaves Teramot.

Internet access with an IP allowlist

Connections to your sources leave Teramot from these fixed egress IP addresses. The application shows the same list when you configure the source. You can restrict access to your system to these IPs only.

Database connections use TLS encryption when the engine supports it.

Network requirements

Your firewall must allow inbound traffic from the Teramot IPs to the port of the source system. These are the default ports, which you can change when configuring the source:

Databricks, Snowflake, BigQuery, and SaaS applications are reached over HTTPS (TCP 443) on the provider’s public endpoints.

To prepare the user and permissions on each system, see Preparing your sources.

SaaS applications

SaaS applications connect through their public APIs, with OAuth or access tokens. They require no network configuration.