Private connections

A private connection is an IPsec site-to-site tunnel between your network and Teramot. It lets Teramot reach a database that is not open to the internet. It belongs to the workspace, and any project in it can use it.

It works with PostgreSQL, MySQL, SQL Server, Oracle DB, MongoDB and SAP ECC (RFC). Anyone can view private connections; creating and changing them needs the Admin role.

If the page says Private connections are not enabled, the feature is not available for your workspace yet — contact support.

1. Create the connection

Where: Advanced → Private connections in the sidebar → Create connection, at the top right of the page (also in the middle of the page while there are none). It is greyed out if your role doesn’t allow it.

Open Private connections (under Advanced in the sidebar) and create one:

• Name (required) and Description (optional).
• Your private networks (CIDRs) — at least one: each private network behind your VPN or firewall that Teramot needs to reach, for example 10.20.0.0/24. Write it in its network form (10.20.0.0/24, not 10.20.0.1/24). Do not enter your firewall’s public IP. Networks cannot repeat or overlap.
• DNS servers and Search domains (optional) — if Teramot should resolve your internal hostnames.

Teramot assigns its own side of the tunnel.

2. Add your VPN endpoint (peer)

Where: Configure your VPN endpoint now is a checkbox in the create form. Add peer is in the Peers section of the connection’s page: Advanced → Private connections → click the connection.

Use Configure your VPN endpoint now while creating, or Add peer later:

Advanced settings, with their defaults: IKE lifetime 28800 s, child lifetime 3600 s, DPD delay 30 s, priority 100 (lower is preferred). Teramot starts the tunnel. Authentication is by pre-shared key.

3. Save the pre-shared key

Where: Copy PSK and Download PSK are in the Save this pre-shared key now box at the top of the connection’s page, shown right after the peer is created or its PSK rotated. Rotate PSK is on the peer’s card in the Peers section of that page.

Teramot generates the pre-shared key (PSK) and shows it only once: Copy PSK or Download PSK right away. Rotate PSK replaces it immediately, so update your firewall at the same time.

4. Configure your firewall

Where: Advanced → Private connections → click the connection → Tunnel configuration section.

The connection page shows the full tunnel configuration (Copy configuration or Download): Teramot’s endpoint, IKE version, Teramot’s networks, your networks, and the proposals for each peer. Configure your VPN device with it, and allow UDP 500 and 4500 from Teramot’s endpoint.

5. Use it in a source

Where: Sources in the sidebar → New source → Connect database → Connectivity → Private Connection.

When adding a PostgreSQL, MySQL, SQL Server, Oracle DB, MongoDB or SAP ECC (RFC) source, choose Private Connection under Connectivity, pick the connection and click Connect. The database host must be inside one of the connection’s networks, or a hostname your DNS servers resolve to one. Connect takes the place of Test Connection: it binds the source to the connection and lists the tables it can see; then continue as usual.

A private connection cannot be deleted while sources use it: remove those sources first.

Connection states

Peer errors