Destination Connection Options

Create SSH user

To create an SSH user, do the following:

1. Log in to your SSH tunnel host.

2. Create group fivetran. Execute:

   sudo groupadd fivetran
   

3. Create user fivetran. Execute:

   sudo useradd -m -g fivetran fivetran
   

4. Switch to the fivetran user. Execute:

   sudo su - fivetran
   

5. Create the .ssh directory. Execute:

   mkdir ~/.ssh
   

6. Set permissions. Execute:

   chmod 700 ~/.ssh
   

7. Change to the .ssh directory. Execute:

   cd ~/.ssh
   

8. Create the authorized_keys file. Execute:

   touch authorized_keys
   

9. Set permissions. Execute:

   chmod 600 authorized_keys
   

10. Add the public SSH key from the Fivetran destination setup form to the authorized_keys file, using your favorite text editor. The key must be all on one line. Make sure that you don’t introduce any line breaks when cutting and pasting. The public SSH key is generated uniquely for each Fivetran destination.

    

IMPORTANT: If you use OpenSSH with version 8.8 or higher, the use of RSA keys are disabled by default. To enable the use of RSA keys, you must modify your sshd_config file (in /etc/ssh) and add the following lines:

PubkeyAcceptedAlgorithms=+ssh-rsa,ssh-rsa-cert-v01@openssh.com
HostKeyAlgorithms=ssh-rsa,ssh-rsa-cert-v01@openssh.com

As an extra layer of security, Fivetran enables TLS on your SSH connection by default. We recommend that you keep TLS enabled unless you know it is safe to forgo it. To disable TLS, set the Require TLS through tunnel toggle to OFF.

IMPORTANT: If you set the Require TLS through tunnel toggle to OFF, Fivetran first attempts to connect over TLS inside the SSH tunnel. If this fails, Fivetran automatically retries the connection in clear text inside the SSH tunnel. You are responsible for configuring this option as per your corporate security policies.

Once the user is created, you'll need to allow port access.

Allow port access

Make sure that port access is allowed from:

• Fivetran's IP to your tunnel server's SSH port
• Your SSH tunnel server to your destination port

If your SSH server and destination happen to be in AWS, you can follow the instructions below to configure port access.

AWS

1. To configure an SSH server in AWS, open the EC2 console and select Running Instances.

   

2. Select the instance you intend to use as an SSH tunnel.

   

3. Select the Security groups and then select default.

   

4. Select the Inbound tab.

5. Click Edit.

   

6. Fill in Fivetran's IP and your SSH port (do not use a load balancer).

7. For VPC or EC2 classic, add a security rule.

   

8. Select SSH, enter Fivetran's IP, and click Save.

   

9. To complete setting up your destination connector, follow the setup instructions for your specific destination. You can confirm your server's SSH key by comparing the SHA 256 displayed when running the setup tests.

   

Install OpenSSH

TIP: Learn more in Microsoft's OpenSSH for Windows overview documentation.

1. Install the sshd server.

   Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
   

2. Verify that the OpenSSH server is installed.

   Get-WindowsCapability -Online | ? Name -like 'OpenSSH.Server*'
   

   NOTE: If OpenSSH is installed, you'll see the following message:

   Name : OpenSSH.Server~~~~0.0.1.0
   
   State : Installed
   

3. Set the firewall to allow inbound TCP connections on port 22.

   New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
   

4. Start both the sshd service and the ssh-agent.

   Start-Service sshd
   Set-Service -Name sshd -StartupType 'Automatic'
   Start-Service ‘ssh-agent’
   Set-Service -Name ‘ssh-agent’ -StartupType 'Automatic'
   

Create Fivetran user and group

IMPORTANT: Windows does not allow a user and a group to have the same name.

1. Add a local Fivetran user.

   net user fivetran <password> /add /comment:"User for establishing SSH connection to Fivetran service." /passwordchg:no /passwordreq:no /logonpasswordchg:no
   

2. Add a Fivetran group.

   net localgroup fivetran-group /comment:"Group for establishing SSH connection to Fivetran service." /add
   

3. In Windows command prompt, switch to the SSH server directory.

   cd C:\ProgramData\ssh\ && start notepad .\sshd_config
   

4. Allow password authentication for the Fivetran user.

   PasswordAuthentication yes
   

5. Allow the Fivetran user to connect to the SSH server. Add the following line to the sshd_config file.

   AllowUsers fivetran
   

6. If your Windows build is 1809 or later, comment out the following lines in the sshd_config file:

   # Match Group administrators                                                    
   # AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
   

7. Save the sshd_config file.

8. Restart the agent and the sshd service. If the following command fails, you can restart from the Task Manager (Alt + Ctrl + Delete).

   Restart-Service ssh-agent; Restart-Service sshd
   

IMPORTANT: If you use OpenSSH with version 8.8 or higher, the use of RSA keys are disabled by default. To enable the use of RSA keys, you must modify your sshd_config file and add the following lines:

PubkeyAcceptedAlgorithms=+ssh-rsa,ssh-rsa-cert-v01@openssh.com
HostKeyAlgorithms=ssh-rsa,ssh-rsa-cert-v01@openssh.com

Set up client

1. In your command line, go into the SSH server using Windows VM.

   ssh fivetran@<Public IPv4 DNS>
   

2. Enter your password.

3. Create an .ssh folder in your home directory.

   mkdir .ssh
   

4. Add an authorized_keys file.

   If your client is Windows PowerShell:

   type nul > authorized_keys
   echo <fivetran-ui-public-key> >> authorized_keys
   icacls C:\Users\fivetran\.ssh\authorized_keys /inheritance:r
   

   If your client is Linux:

   touch authorized_keys
   chmod 600 authorized_keys
   echo <fivetran-ui-public-key> >> authorized_keys
   

If you're running PowerShell in elevated mode, your setup is complete. If you're not running PowerShell in elevated mode, follow the instructions below.

TIP: An elevated PowerShell prompt displays Administrator: Windows PowerShell on the top of the prompt's border.

Finish setup (non-elevated PowerShell only)

1. Allow public key authentication.

   PubkeyAuthentication yes
   

2. Remove password authentication.

   PasswordAuthentication no
   PermitEmptyPasswords no
   

3. Save the sshd_config file.

4. Verify that inheritance has been disabled and remove Administrator.
   a. Right click on the authorized_keys file.
   b. Select Properties.
   c. Select the Security tab.
   d. Select Advanced.
   e. Verify that the bottom left reads Enable Inheritance, which means that inheritance is disabled.
   f. Remove Administrator from the file security permissions.
   

5. Restart the agent and the sshd service.

   Restart-Service ssh-agent; Restart-Service sshd
   

Generate private key

1. Launch PuTTYgen.

2. Under Actions, click Generate to generate a public/private key combination. The OpenSSH public key appears in the top box.

3. Make a note of your OpenSSH public key. You will need this later.

4. Click Save private key. When you're prompted to save a .ppk file, save the file on your desktop.

TIP: You do not need to save the key with a passphrase.

Configure connection

1. Launch KiTTY (run kitty-0.74.4.7.exe on your desktop).

2. Configure your session.

   • Host Name: Enter fivetran@<GCP VM IP>
   • Port: 22

3. In the left menu, click Auth.

4. In the Private key file for authentication field, enter the private key you created in the previous step.

5. Click Tunnels.

6. In the Port forwarding section, make sure that the following checkboxes are selected:

   • Local ports accept connections from other hosts
   • Remote ports do the same

7. In the Source port field, add the high port (55432).

8. In the Destination field, add your destination address and its corresponding port (for example, localhost:5432 for a server hosted on the same VM).

9. Make sure that Remote is selected.

10. Click Add to add a port forwarding rule.

11. In the left menu, go to Connection.

12. Set the seconds between keepalives value to 5.

13. Select both Reconnect options.

14. Return to the Tunnels page.

15. In the Saved Sessions/New Folder field, enter a name for this connection.

16. Hit Save. Another session populates in the bottom box.

17. Click Open, then leave the session open.

To set up a reverse SSH tunnel to connect to Fivetran:

1. Contact Fivetran's Sales Engineers and provide the following SSH keys:

   • Fivetran user's SSH public key

   • Your SSH public key. To generate your SSH public key, do the following on your SSH host:

     i. Generate an SSH key pair. Execute: ssh-keygen.

     ii. View the contents of the public key. Execute: cat ~/.ssh/id_rsa.pub.

   Copy the public key and send it to Fivetran's sales engineers along with the Fivetran user's SSH public key.

2. Collect the following information to complete your setup:

   • SSH tunnel username (contact Fivetran's Support to get this)
   • Reverse SSH port (contact Fivetran's Support to get this)
   • Internal IP address or name of the local destination host machine
   • Internal open port for communication with the destination host
   • File path to the private key on the SSH host machine (this is normally id_rsa.pem or simply id_rsa)

3. Use the values above to replace the placeholder variables in the following script, then run it on the SSH host in a single line:

   autossh -M 0 -f -N -R <SSH_HIGH_PORT>:<LOCAL_DB_MACHINE_NAME_OR_IP>:<LOCAL_DB_MACHINE_PORT> <FIVETRAN_SSH_USERNAME>@<FIVETRAN_SUPPLIED_IP> -g -i <PATH_TO_PRIVATE_KEY> -o ServerAliveInterval=10 -o ServerAliveCountMax=1 -o ExitOnForwardFailure=yes
   

   TIP: To track the progress of this script, remove the -f flag and add the -v flag to enable verbose logging. Without the flag, you will not see confirmation when the script finishes running successfully.

   NOTE: If you use this autossh script again later for the same SSH high port, you need to terminate your original autossh script before proceeding.

4. After establishing a successful Reverse SSH connection, enter the following into the Fivetran setup form for your destination. Replace the fields in { brackets } with your own values.

   Field	Value	Description
   Host	localhost	Allows your SSH host to handle port routing
   Port	{ SSH high port }	e.g., 13306. The port that your SSH host will translate
   User	{ Destination user }
   Password	{ Destination user's password }
   Database	{ Database name }	The database name you want to replicate to
   Connection Method	Connect using SSH Tunnel
   SSH Host	{ IP Address }	Supplied by Fivetran
   SSH Port	22
   SSH User	fivetran

1. Start a new PuTTY session.

2. Configure your session.

   • Host Name: Enter the Fivetran server
   • Port: 22

3. Go to Connection > Data, then enter fivetran as the tunnel username.

4. In the left menu, go to Connection > SSH.

5. Select the Don’t start a shell or command at all checkbox.

6. Go to Connection > SSH > Auth.

7. Click Browse to find your PPK private key.

8. Under Auth, go to TTY.

9. Select the Don’t allocate a pseudo terminal checkbox.

10. Go to Connection > SSH > Tunnel.

11. In the Source port field, enter the connection port assigned to your connection (for example, 53359).

12. In the hostname:port field, enter your destination's host and port (for example, 127.0.0.1:5432).

13. Make sure that Remote is selected.

14. Click Add.

15. To save the connection, click Session in the left menu.

16. In the Saved Sessions section, enter a name for your stored session, then click Save.

17. Double-click the session name to initiate the connection.

1. Configure the NLB for each subnet (availability zone) where you want the service to be available.

2. Create a VPC endpoint service configuration and specify your NLB.

   IMPORTANT: Make sure that you are familiar with the endpoint service considerations and you have met its prerequisites.

3. Safelist Fivetran’s AWS VPC Account ID (arn:aws:iam::834469178297:root) to allow access to your VPC endpoint service.

   TIP: To learn how to safelist the Fivetran account ID, see AWS' documentation.

4. Send the following details to your Fivetran account manager and we will complete the setup:

   • Service name (VPCe) (for example, com.amazonaws.vpce.<region_id>.vpce-svc-xxxxxxxxxxxxxxxxx)
   • Host name of the service/destination

5. Activate the connection by accepting the interface endpoint connection request from Fivetran.

   NOTE: By default, you must manually accept the connection request. However, you can configure the acceptance settings of your endpoint service so that the connection request is automatically accepted.

The self-service functionality is not available by default. Contact your Fivetran account manager to enable this functionality for you.

Find connection service name

1. Log in to your AWS account.

2. Configure the NLB for each subnet (availability zone) where you want the service to be available.

3. Create a VPC endpoint service configuration and specify your NLB.

   IMPORTANT: Make sure that you are familiar with the endpoint service considerations and you have met its prerequisites.

4. Safelist Fivetran’s AWS VPC Account ID (arn:aws:iam::834469178297:root) to allow access to your VPC endpoint service.

   TIP: To learn how to safelist the Fivetran account ID, see AWS' documentation.

5. Make a note of your service name (VPCe) (for example, com.amazonaws.vpce.<region_id>.vpce-svc-xxxxxxxxxxxxxxxxx). You will need it to configure Fivetran.

6. Activate the connection by accepting the interface endpoint connection request from Fivetran.

   NOTE: By default, you must manually accept the connection request. However, you can configure the acceptance settings of your endpoint service so that the connection request is automatically accepted.

Configure PrivateLink connection

1. Log in to the Fivetran dashboard and go to the destination setup form.

2. In the Connection Method drop-down menu, select Connect via Private Networking.

3. Click + Configure a new PrivateLink connection.

4. Enter a Name for your PrivateLink connection.

5. In the PrivateLink connection service name field, enter the service name you found in Step 1.

6. Click Create and save. Fivetran will raise a connection request in AWS.

   NOTE: It might take up to 10 minutes for us to raise the connection request.

Accept connection request

1. Go to your AWS account.

2. In the top left corner, click Services, and then select VPC.

3. In the VPC dashboard, click Endpoint services.

4. Refresh the Endpoint services page to see the new connection request from Fivetran. The new connection request is in Pending acceptance state.

   NOTE: It might take some time for the new connection request to appear on the list.

5. Select the new connection request.

6. Go the Endpoint connections tab.

7. In the Actions drop-down menu, select Accept endpoint connection request.

8. In the Accept endpoint connection request pop-up window, enter accept in the text box, and then click Accept. The status of the request will change to Pending. After a few minutes, the status will change to Accepted and a Connection created message will appear in your destination setup form.

IMPORTANT: These setup instructions are not applicable to Azure Data Lake Storage, Azure Synapse, Databricks, and Snowflake destinations. To connect these destinations using Azure Private Link, see their setup guides.

Instructions for destinations

1. Verify that your destination supports Private Endpoint. For more information, see Microsoft’s documentation.
2. Contact your Fivetran account manager and provide your Azure-hosted service’s fully-qualified resource ID, including the resource name and resource type of your destination.
3. Wait to receive Private Endpoint request details from Fivetran. We create a Private Endpoint using your resource ID, type, and subresource. We then initiate a Private Link connection request as part of the Private Endpoint setup and share the details of that request with you.
4. In the Azure Portal or CLI, verify and approve the Private Link connection request from Fivetran. Once you approve the request, Fivetran completes the Private Link setup for your Azure-hosted service.

Self-service instructions for destinations Private Preview

The self-service functionality is not available by default. Contact your Fivetran account manager to enable this functionality for you.

Find resource ID

1. Verify that your destination supports Private Endpoint. For more information, see Microsoft’s documentation.
2. Log in to the Azure portal and then go to your Azure-hosted service.
3. Select your workspace and then go to Properties.
4. Make a note of the Resource ID. You will need it to create the Private Link connection.

Configure Private Link connection

1. Log in to the Fivetran dashboard and go to the destination setup form.

2. In the Connection Method drop-down menu, select Connect via Private Networking.

3. Click + Configure a new PrivateLink connection.

4. Enter a Name for your Private Link connection.

5. In the PrivateLink Resource ID field, enter the resource ID you found in Step 1.

6. In the PrivateLink Subresource name drop-down menu, select the subresource corresponding to your resource type. The following table lists the subresources corresponding to each resource type:

   Resource Type	Subresource
   Azure SQL Managed Instance	managedInstance
   Azure SQL Database	sqlServer
   Azure Blob Storage (Azure Storage)	blob, dfs
   Azure Service Bus	namespace
   Azure PostgreSQL Database	postgresqlServer
   Azure Cosmos DB	sql
   Azure Mongo DB	MongoDB

7. Click Create and save. Fivetran will raise a connection request in Azure.

   NOTE: It might take up to 10 minutes for us to raise the connection request.

Accept connection request

1. Go to your Azure account.
2. Go to Private Link Center > Pending connections.
3. Select the connection request from Fivetran, and click Approve.
4. In the pop-up window, confirm that you want to approve the connection request. Once Azure processes the request, a Connection created will appear in your destination setup form.

IMPORTANT: These setup instructions are not applicable to Azure Data Lake Storage, Azure Synapse, Databricks, and Snowflake destinations. To connect these destinations using Azure Private Link, see their setup guides.

Depending on whether or not your destination already has an Azure Private Link Service, do one of the following:

• If your destination is already configured with a Private Link Service, follow the setup instructions for Azure-hosted destinations.
• If your destination does not have a Private Link Service, set up the service and then follow the setup instructions for Azure-hosted destinations. For more information about setting up a Private Link Service, see the Setup instructions for Private Link Service section of this documentation.

NOTE: A single Azure Private Link Service can support one or multiple destinations at the same time with different ports mapped to corresponding destination IP addresses.

Setup instructions for Private Link Service

Prerequisites

To set up Private Link Service, you must do the following:

• Configure a VNet with access to your destination.
• Ensure that your destination is accessible from the VNet where the Private Link Service Load Balancer will run.

Setup instructions

1. In the VNet, create a Standard Load Balancer with a NIC-based backend pool that has access to your destination.

2. Configure a health probe and a load balancer rule with the ports that your destination will use. For more information, see Azure's documentation.

3. Create a Private Link Service associated with the Standard Load Balancer you created in step 1. For more information, see Azure's documentation.

4. Create one or more Virtual Machines and place them in the backend pool of the load balancer you created in step 1.

5. Enable IP forwarding on each of the backend Virtual Machine network interfaces. For more information about how to enable IP forwarding, see Azure's documentation.

6. For security reasons, ensure that no public IP addresses are configured for the Virtual Machines. Private Link connections use only private IP addresses.

7. Log in into each backend Virtual Machine of the Load Balancer and run the script below. The script configures Network Address Translation (NAT), which forwards network packets from SLB-backend Virtual Machines to your destination. The script also configures a single port forwarding. However, you can add additional sets of iptables PREROUTING and POSTROUTING rules for additional ports.

   #!/bin/bash
   
   # This script configures Network Address Translation to forward incoming packets
   # from the Azure Standard Load Balancer to IP-based destinations and route them
   # back. In this script, "destination" means a destination server that Fivetran connects to.
   
   # local port where Load Balancer sends traffic to
   SOURCE_PORT=<local_port>
   # destination server inside internal network
   DESTINATION_IP=<destination_server_ip_address>
   DESTINATION_PORT=<destination_server_port>
   
   # enable IP forwarding on host
   echo 1 > /proc/sys/net/ipv4/ip_forward
   
   # clear existing iptables rules and chains
   iptables -F
   iptables -t nat -F
   iptables -X
   
   # change the packet recipient from local to destination socket (host & port)
   iptables -t nat -A PREROUTING -p tcp --dport ${SOURCE_PORT} -j DNAT --to-destination ${DESTINATION_IP}:${DESTINATION_PORT}
   
   # change the source IP address from the LB NAT IP address to the IP of this LB-backend host
   iptables -t nat -A POSTROUTING -p tcp -d ${DESTINATION_IP} --dport ${DESTINATION_PORT} -j SNAT --to-source $(hostname -i)
   

NOTE: For additional help, read Azure’s Private Link Service documentation or contact your Fivetran account manager.

We support connecting to any GCP-hosted resource as long as it is supported by Fivetran and exposed through Private Service Connect producer.

In the following example, we publish a service that runs on a specific instance. However, there are several other ways to expose your service. To learn more, contact your administrators or read Google's documentation.

You need the following as inputs for the commands used in the steps below:

• <NETWORK> - VPC network in which the exposed resource exists
• <SUBNET> - Subnetwork where the exposed resource exists
• <ILB_SUBNET> - Subnetwork used for allocation of internal load balancer addresses (forwarding rules)
• <PSC_NAT_SUBNET> - Subnetwork used for allocation IPs for each customer endpoint address
• <REGION> - Region where the exposed resource exists
• <ZONE> - Zone where the exposed resource exists
• <VM_NAME> - VM on which the exposed resource runs
• <VM_IP> - Private IP on which the exposed resource is available
• <RESOURCE_PORT> - Port on which the exposed resource is available in a VM
• <NETWORK_ENDPOINT_GROUP> - Network endpoint group
• <HEALTH_CHECKS> - Port health checks
• <BACKEND_SERVICES> - Backend services
• <FORWARDING_RULE> - Forwarding rule
• <SERVICE_ATTACHMENT> - Service attachment

IMPORTANT: If you already have a regional internal load balancer for your resource, skip to Step 8 of this example.

1. Create a network endpoint group.

   gcloud compute network-endpoint-groups create --network <NETWORK> --subnet <SUBNET> \
    --network-endpoint-type gce-vm-ip --zone <ZONE> <NETWORK_ENDPOINT_GROUP>
   

2. Add an instance with the running resource as an endpoint to the network endpoint group.

   gcloud compute network-endpoint-groups update --zone <ZONE> <NETWORK_ENDPOINT_GROUP> \
    --add-endpoint='instance=<VM_NAME>
   

3. Create health checks to automatically enable and disable the instance. In this example, we use port checks.

   gcloud compute health-checks create tcp --region <REGION> --check-interval=60s 
    --port=<RESOURCE_PORT> <HEALTH_CHECKS>
   

4. Create the backend services.

   gcloud compute backend-services create --region=<REGION> --health-checks=<HEALTH_CHECKS> \
       --health-checks-region=<REGION> --load-balancing-scheme=INTERNAL <BACKEND_SERVICES>
   

5. Assign the network endpoint group you created at the backend.

   gcloud compute backend-services add-backend <BACKEND_SERVICES> --network-endpoint-group=<NETWORK_ENDPOINT_GROUP> \
       --network-endpoint-group-zone=<ZONE>
   

6. (Optional) Allocate a subnetwork dedicated to forwarding rules.

   cloud compute networks subnets create --network <_NETWORK_> --region <REGION> 
       --range=10.0.X.0/24 <ILB_SUBNET>
   

7. Create a forwarding rule for the internal load balancer. It points to <BACKEND_SERVICES> and allocates the IP address from <ILB_SUBNET> in <NETWORK>.

   gcloud compute forwarding-rules create --backend-service=<BACKEND_SERVICES> --region <REGION> \
       --load-balancing-scheme=INTERNAL --ports=ALL --subnet=<ILB_SUBNET> --network=<NETWORK> <FORWARDING_RULE>
   

8. Allocate a NAT subnetwork dedicated to creating endpoints for each connected customer.

   cloud compute networks subnets create --network <NETWORK> --region <REGION> --range=10.0.X.0/24  \
    --purpose=PRIVATE_SERVICE_CONNECT <_PSC_NAT_SUBNET_>
   

9. Open traffic from the ILB and NAT networks to a VM or port using the corresponding ranges specified in previous steps.

   gcloud compute firewall-rules create --direction=INGRESS --priority=1000 --network=<_NETWORK_> --action=ALLOW \
       --rules=tcp:_RESOURCE_PORT_ --source-ranges=10.0.X.0/24 --destination-ranges=<_VM_IP_>/32 db-demo-allow-psc-nats
   
   gcloud compute firewall-rules create --direction=INGRESS --priority=1000 --network=<_NETWORK_> --action=ALLOW \
       --rules=tcp:_RESOURCE_PORT_ --source-ranges=10.0.X.0/24 --destination-ranges=<_VM_IP_>/32 db-demo-allow-ilb-nats
   

10. Create a service attachment and point it to the internal load balancer you created above (FORWARDING_RULE) with manual accepting mode.

    gcloud compute service-attachments create --producer-forwarding-rule=<FORWARDING_RULE> --connection-preference=ACCEPT_MANUAL \
        --region=<REGION> --description='Producer for my resource in region' --nat-subnets <_PSC_NAT_SUBNET_> <SERVICE_ATTACHMENT>
    

11. Contact Fivetran to set up a Private Service Connect link in Fivetran. Fivetran will provide a PSC_CONNECTION_ID, which allows you to identify the connections that come from Fivetran before you approve them.

NOTE:

• If you want to auto-approve the Fivetran project, use the --consumer-accept-list=fivetran_donkeys=2 parameter for gcloud.
• The instructions above use network endpoint groups as it is easy to attach them to existing VMs. However, if a VM is already part of the instance groups, you can use it directly as a backend services target.
• You can test a newly-created producer in another VPC by allocating an IP and creating a forwarding rule, as described in Google's documentation.

To set up access for Google Cloud SQL destinations through private IP, you need an additional VM to act as a forwarding proxy. You can use solutions like HAProxy or iptables for this.

NOTE: If you use the following vm script, make sure that you persist iptables rules and consider using instance groups instead of standalone VMs.

#!/bin/bash

# This script configures Network Address Translation to forward incoming packets
# from the Load Balancer to IP-based destinations and route them
# back. In this script, "destination" means a destination server that Fivetran connects to.

# local port where the Load Balancer sends traffic to
SOURCE_PORT=<local_port>
# destination server inside internal network
DESTINATION_IP=<destination_server_ip_address>
DESTINATION_PORT=<destination_server_port>

# enable IP forwarding on host
echo 1 > /proc/sys/net/ipv4/ip_forward

# clear existing iptables rules and chains
iptables -F
iptables -t nat -F
iptables -X

# change the packet recipient from local to destination socket (host & port)
iptables -t nat -A PREROUTING -p tcp --dport ${SOURCE_PORT} -j DNAT --to-destination ${DESTINATION_IP}:${DESTINATION_PORT}

# change the source IP address from the LB NAT IP address to the IP of this LB-backend host
iptables -t nat -A POSTROUTING -p tcp -d ${DESTINATION_IP} --dport ${DESTINATION_PORT} -j SNAT --to-source $(hostname -i)

Once you set up the VMs, follow the standard setup instructions for Google Cloud Private Service Connect.