Reach databases in your private network

Many companies keep their databases in a private network with no address on the internet. For them, Scavenger AI sets up a Tenant network: a network of your Tenant’s own in our infrastructure, joined to your private network by a site-to-site VPN. Only your Tenant’s queries use it, and nothing in it can reach the internet.

Ask for a Tenant network

Our staff set up every Tenant network together with your network team, because every company’s network is different. Contact Scavenger AI and have ready:

• the public IPv4 address of your VPN device;
• whether you route statically or with BGP, and your device’s ASN for BGP;
• the private address ranges your databases are in. Queries reach nothing outside them.

We then agree on the address range our side uses. Your address ranges may be the same as other companies’. We send you the VPN configuration for your device, with both tunnels’ addresses and keys, through a channel we agree on. Once your team has configured the device and a tunnel is up, the Data Studio offers the private network.

Queries reach your databases from our side’s address range, through the tunnel. Allow that range on your databases’ firewalls, not the public addresses that the Data Studio lists for public Data Sources.

Add a Data Source on the private network

Add it as any other Data Source (see Connect a Data Source), and choose Private network under Network. The connection test then goes through the tunnel:

• The address failed: the host doesn’t resolve to an address in your private ranges. Use the database’s private IP address, or a name that resolves to it in public DNS: names that only your own DNS servers know don’t resolve.
• The network failed: nothing answered in time. Check the port, your database’s firewall, and whether the tunnel is up.

Only Tenants with a Tenant network see the choice. Data Sources on the private network are marked Private network in the list.

Use the private network in the Sandbox

Set a Data Source on the private network to Also in the Sandbox, and code the agent runs can connect to it directly, as described in Also in the Sandbox. That code runs in your Tenant network, through the tunnel, from our side’s address range: the firewall rule for queries covers it too.

• No internet there. While a user’s Data Sources include one on the private network set to Also in the Sandbox, their code runs in the Tenant network and has no internet access, even with the Right “Sandbox has internet access”. It can’t download data or install packages, and it can’t reach public Data Sources set to Also in the Sandbox: the agent says so and queries those with the query tool instead.
• A changed set starts afresh. When such a Data Source is added to a user’s set or leaves it, their next run of code starts in a new Sandbox, so variables and files of earlier runs are gone.

See whether the tunnel is up

If you may create Data Sources, the Data Sources page of the Data Studio shows the section Private network. It says whether the tunnel to your private network is up, and when each of the VPN connection’s two tunnels last went up or down. It is read again every minute.

While both tunnels are down, queries to Data Sources on the private network fail. Check your VPN device first; if it stays down, contact Scavenger AI. Keep both tunnels configured on your device: we maintain one tunnel at a time, so the other keeps your queries going.

Remove a Tenant network

Contact Scavenger AI. We remove it with your network team; Data Sources on the private network stop working, so delete them first. Records of the traffic through it are kept for one year.