Destination Connection Options

There are three ways to connect Fivetran to your destination:

• Directly by whitelisting Fivetran’s IP
• Using an SSH tunnel
• Using a reverse SSH tunnel

Whitelist Fivetran’s IPlink

The fastest and easiest way to connect is to allow Fivetran’s IP direct access to your destination port. For more information about how to do this, visit the setup guide for your destination.

SSH Tunnellink

If it’s not possible to provide direct access to the destination port, you can connect to Fivetran using an SSH tunnel. You can also choose this connection method for an added layer of security. To connect using an SSH tunnel, you need to:

• Set up an SSH tunnel server that has access to your destination port. The tunnel server’s SSH port needs to be accessible from Fivetran’s IP.
• Create an SSH user for Fivetran.

IMPORTANT: Fivetran generates a unique public SSH key for each destination. We support multiple connectors with a single SSH tunnel depending on the data volume and network bandwidth.

Create SSH userlink

Log in to your SSH tunnel host and run the following commands:

Create group fivetran

sudo groupadd fivetran

Create user fivetran

sudo useradd -m -g fivetran fivetran

Switch to the fivetran user

sudo su - fivetran

Create the .ssh directory

mkdir ~/.ssh

Set permissions

chmod 700 ~/.ssh

Change to the .ssh directory

cd ~/.ssh

Create the authorized_keys file:

touch authorized_keys

Set permissions

chmod 600 authorized_keys

Using your favorite text editor, add the public SSH key from the destination setup page in your Fivetran dashboard to the authorized_keys file. The key must be all on one line. Make sure that you don’t introduce any line breaks when cutting and pasting. The public SSH key is generated uniquely for each Fivetran destination.

Once the user is created, you’ll need to allow port access.

Allow port accesslink

Make sure that port access is allowed from:

1. Fivetran’s IP to your tunnel server’s SSH port
2. Your SSH tunnel server to your destination port

If your SSH server and destination happen to be in AWS, you can follow the instructions below to configure port access.

Reverse SSH tunnellink

You can also connect Fivetran to your destination using a reverse SSH tunnel if you are unable to provide direct port access to your destination instance.

To set up a reverse SSH tunnel to connect to Fivetran, contact Fivetran’s Sales Engineers and provide the following SSH keys:

• Fivetran user’s SSH public key
• Your SSH public key

To generate your SSH public key, do the following on your SSH host:

1. Generate an SSH key pair.

   ssh-keygen

2. View the contents of the public key. Copy the public key and send it to Fivetran’s sales engineers along with the Fivetran user’s SSH public key.

   cat ~/.ssh/id_rsa.pub

Once we have both keys, you will need the following information to complete your setup:

• SSH tunnel username (contact Fivetran Support to get this)
• Reverse SSH port (contact Fivetran Support to get this)
• Internal IP address or name of the local destination host machine
• Internal open port for communication with the destination host
• File path to the private key on the SSH host machine (this is normally id_rsa.pem or simply id_rsa)

Use the values above to replace the placeholder variables in the following script, then run it on the SSH host in a single line:

TIP: To track the progress of this script, remove the -f flag and add the -v flag to enable verbose logging. Without the flag, you will not see confirmation when the script finishes running successfully.

autossh -M 0 -f -N -R <SSH_HIGH_PORT>:<LOCAL_DB_MACHINE_NAME_OR_IP>:<LOCAL_DB_MACHINE_PORT> <FIVETRAN_SSH_USERNAME>@<FIVETRAN_SUPPLIED_IP> -g -i <PATH_TO_PRIVATE_KEY> -o ServerAliveInterval=10 -o ServerAliveCountMax=1 -o ExitOnForwardFailure=yes

If you use this autossh script again later for the same SSH high port, you need to terminate your original autossh script before proceeding.

After establishing a successful Reverse SSH connection, enter the following into the Fivetran setup form for your destination:

All fields in { brackets } must be replaced with your own values.