How-to | Access data sources through a VPN server#

VPN IPSec#

You can configure an VPN IPSec tunnel between Dataiku Cloud and your network to access your private data sources.

Each VPN tunnel configuration tends to have unique edge cases. Please contact the Dataiku account team to complete this configuration.

Important

  • VPN isn’t available in all Dataiku plans. You may need to reach out to your Dataiku Account Manager or Customer Success Manager.

  • The private subnets exposed by your VPN IPSec Gateway shouldn’t overlap with the following CIDR ranges: 10.0.0.0/16, 10.1.0.0/16, 172.20.0.0/16, 10.11.0.0/16, 10.94.0.0/16, and 10.95.0.0/16.

  • To enable VPN tunneling, you need to restart the Dataiku instances. This operation could take up to 15 minutes.

To configure the VPN:

  1. Go to Launchpad’s Extensions panel.

  2. Add the IPsec extension.

  3. Provide an IPsec configuration file for clients.

You can choose between:

Routing all traffic

If you select this option, all outgoing traffic from Dataiku will go through the VPN tunnel. In this case, ensure that all your data sources are accessible from your VPN server, and that your VPN server can also route traffic to the internet so your Cloud instances can function properly.

Routing the traffic to a list of IP ranges

If you deselected the all traffic option, you must list all addresses or ranges for which the traffic will be routed through the VPN.

Custom DNS servers#

You can optionally configure custom DNS servers. This allows you to use your own DNS servers to resolve the domains of your private data sources accessed through the VPN.

In the Launchpad VPN extension, you can specify multiple DNS servers by providing their IP addresses. For each DNS server, you can associate a list of domains that should be resolved using it. The domains assigned to each DNS server can be distinct or overlapping. The default Dataiku DNS servers will continue to resolve any domains not specified.

Tip

Suppose you have two private domains: internal.company.com and private.company.net.

  • You can assign internal.company.com to DNS server 10.30.0.5 and private.company.net to DNS server 10.30.0.6. For example: internal.company.com=10.30.0.5,private.company.net=10.30.0.6.

  • The default Dataiku DNS servers will resolve any other domains.