Proxy Agent

You must have a Standard, Enterprise, or Business Critical plan to use Proxy Agent.

The Fivetran Proxy Agent lets Fivetran securely connect to a database that isn't publicly accessible, such as one in a private network or on-premises environment. The Proxy Agent runs inside your network and establishes an outbound-only connection to the Fivetran Managed SaaS. This design lets Fivetran communicate with your database without opening inbound firewall ports or exposing it to the public internet.

Each Proxy Agent is uniquely identified by an agent ID in its configuration file (config.json). Only one Proxy Agent process can be active for a given agent ID at a time.

Do not run multiple Proxy Agent processes using the same configuration file or agent ID. Doing so can disconnect the agent and cause connection sync failures and other unexpected behavior.

Fivetran has retired the legacy Proxy Agent infrastructure. A JAR-based Proxy Agent running a version earlier than 1.1.0, or version 1.1.0 or later with "enable_migration": false in its configuration file (proxyagent.conf), may no longer connect, causing affected connections to fail. When the legacy infrastructure is no longer available, upgrading the JAR-based installation in place or changing enable_migration alone will not restore connectivity. To retain the existing agent ID, migrate directly to Docker by following the Upgrade to Docker guide. The Docker installer uses the credentials in the existing configuration file to request a new configuration and does not depend on the legacy infrastructure. If the Docker migration fails, create a new Proxy Agent and assign it to the affected connections.

Network architecture

During normal operation, the Proxy Agent establishes and maintains an outbound gRPC control connection to Fivetran over port 443, secured with mutual TLS (mTLS). The agent may also open additional outbound TLS-encrypted connections over port 443 as needed. The Proxy Agent supports TLS 1.3 and earlier versions.

All connections are outbound only. You do not need to open inbound ports on the Proxy Agent host. For the endpoints you need to allow, see the network requirements in the setup guide for your deployment method.

If your network requires outbound traffic to pass through an intermediate network proxy, follow the proxy configuration instructions in the setup guide for your deployment method.

Region scope

A Proxy Agent is not limited to a single region. It can route syncs through Proxy Servers in the region where each sync runs, so a single Proxy Agent can support connections across multiple regions. Safelist the Proxy Server hostname for every region your Proxy Agent serves, not just one.

We recommend deploying a Proxy Agent in the same region as, or a physically close region to, the Fivetran infrastructure it serves to improve latency and reliability.

Supported connectors

You can use Proxy Agent with the following connectors:

A Proxy Agent can support multiple connections. However, we recommend that you use a maximum of 30 connections per Proxy Agent.

System architecture

The following diagrams show how the Proxy Agent integrates with your connections depending on whether your connector uses a High-Volume Agent (HVA).

For the supported High-Volume Agent (HVA) connectors, this connection method requires the Proxy Agent to be installed on the HVA's host or on a host that has access to HVA. See the sample system architecture with Proxy Agent and HVA below.

Proxy Agent System Architecture

For non-HVA connectors, the source communicates directly with the Proxy Agent.

Proxy Agent Non-HVA System Architecture

Setup guides

Select the setup guide for your preferred deployment method:

DockerPrivate Preview — Deploy the Proxy Agent as a Docker container on Linux or Windows.
Binary Distribution — Install the Proxy Agent as a service on Linux or Windows Server using the standalone ZIP file.

To upgrade an existing installation, see Upgrade to Docker.