Azure Private Link

We support connecting to the following Azure-hosted sources using Private Link:

• Azure Blob Storage
• Azure Cosmos DB for MongoDB
• Azure Cosmos DB for NoSQL
• Azure Functions
• Azure Database for MariaDB
• Azure Database for MySQL
• Azure Database for PostgreSQL
• Azure SQL Database
• Azure SQL Managed Instance

The following graphic illustrates how Azure Private Link establishes a connection between the Fivetran network and the customer network. Fivetran uses Private Endpoints to establish a Private Link with the Azure Database for MySQL and Snowflake.

To establish a Private Link connection, do the following:

1. Verify that your Azure-hosted source supports Private Endpoint in Microsoft’s Private Endpoint documentation.
2. Create a Fivetran support ticket and provide your Azure-hosted service’s fully-qualified resource ID, including the resource name and resource type of your Azure-hosted source.
3. Wait to receive Private Endpoint request details from Fivetran. We create a Private Endpoint using your resource ID, type, and subresource. We then initiate a Private Link connection request as part of the Private Endpoint setup and share the details of that request with you.
4. In the Azure Portal or CLI, verify and approve the Private Link connection request from Fivetran. Fivetran then finishes setting up Private Link for your Azure-hosted service on our side.

How you set up Private Link for your Azure Virtual Machine-hosted or on-premises source depends on whether or not your source already has an Azure Private Link Service.

If your source is already configured with a Private Link Service, follow the setup instructions for Azure-hosted sources to complete your Fivetran setup.

If you do not have a Private Link Service yet, you will need to configure one before establishing a Private Link connection by following the steps below:

1. Inside the VNet, create a Standard Load Balancer with a NIC-based backend pool that has access to your data sources. Configure a health probe and a load balancer rule with the ports that your connections will use. Learn how in Azure's Create a load balancer guide.
2. Create a Private Link Service associated with the load balancer that you created in step 1. Learn how in Azure's Create a private link service guide.
3. Create one or more Virtual Machines and place them in the backend pool of the load balancer you created in step 1.
4. Enable IP forwarding on each of the backend Virtual Machine network interfaces. Learn how to enable IP forwarding in Azure's Enable IP forwarding documentation.
5. For security purposes, ensure that no public IP addresses are configured for the Virtual Machines. Private Link connections use only private IP addresses.
6. (Optional) Log in to each Load Balancer-backend Virtual Machine and run the script below. The script configures Network Address Translation (NAT), which forwards network packets from SLB-backend Virtual Machines to your data sources. The script below configures a single port forwarding, but feel free to add additional sets of iptables PREROUTING and POSTROUTING rules for additional ports:

#!/bin/bash

# This script configures Network Address Translation to forward incoming packets
# from the Azure Standard Load Balancer to IP-based destinations and route them
# back. In this script, "destination" means a data source server that Fivetran connects to.

# local port where Load Balancer sends traffic to
SOURCE_PORT=<local_port>
# destination server inside internal network
DESTINATION_IP=<destination_server_ip_address>
DESTINATION_PORT=<destination_server_port>

# enable IP forwarding on host
echo 1 > /proc/sys/net/ipv4/ip_forward

# clear existing iptables rules and chains
iptables -F
iptables -t nat -F
iptables -X

# change the packet recipient from local to destination socket (host & port)
iptables -t nat -A PREROUTING -p tcp --dport ${SOURCE_PORT} -j DNAT --to-destination ${DESTINATION_IP}:${DESTINATION_PORT}

# change the source IP address from the LB NAT IP address to the IP of this LB-backend host
iptables -t nat -A POSTROUTING -p tcp -d ${DESTINATION_IP} --dport ${DESTINATION_PORT} -j SNAT --to-source $(hostname -i)

For additional help, read Microsoft’s Private Link Service documentation or create a Fivetran support ticket.

With self-service, you can enable Azure Private Link on the following sources:

• Azure Cosmos DB for MongoDB
• Azure Cosmos DB for NoSQL
• SQL Server

Find resource ID

1. Verify that your source supports Private Endpoint. For more information, see Microsoft’s documentation.
2. Log in to the Azure portal and then go to your Azure-hosted service.
3. Select your workspace and then click on JSON View.
4. Save the Resource ID. You will need it to create the Private Link connection.

Configure Private Link connection

1. In Fivetran's connection setup form, select Connect via private networking in the Connection Method drop-down menu.

2. Click + Configure a new Private Link connection.

3. Enter a Name for your Private Link connection.

4. In the Private Link Resource ID field, enter the resource ID you found in Step 1.

5. In the Private Link Subresource name drop-down menu, select the subresource corresponding to your resource type. The following table lists the subresources corresponding to each resource type:

   Resource Type	Subresource
   Azure Cosmos DB for MongoDB	MongoDB
   Azure Cosmos DB for NoSQL	sql
   Azure SQL Database	sqlServer

6. (Optional) Click the Add DNS record manually checkbox to provide a list of private DNS record names. This should correspond to the record sets found in the private DNS zone, in the exact order in which they are listed. We recommend that you manually provide these record names to avoid any potential connection errors.

7. Click Create and save. Fivetran will raise a connection request in Azure.

   It might take up to 10 minutes for us to raise the connection request.

Accept connection request

1. Go to your Azure account.
2. Go to Private Link Center > Pending connections.
3. Select the connection request from Fivetran, then click Approve.
4. In the pop-up window, confirm that you want to approve the connection request. Once Azure processes the request, a Connection created message will appear in Fivetran's connection setup form.
5. Update your username to <username>@dbname.