Supersimple

Appearance

Connect a data warehouse through OpenVPN ​

Supersimple can connect to a supported database or data warehouse that is available only through OpenVPN. Supersimple runs an OpenVPN client on its side, keeps a single tunnel open to your VPN endpoint, and sends database traffic through it. Your database never needs to be exposed to the internet.

Assisted setup

OpenVPN connections are currently set up with your Supersimple onboarding team. If you are already using Supersimple, contact support to get started.

How it works ​

  • Supersimple keeps one long-lived VPN session open using the profile you provide, and reconnects automatically if the session drops. Expect a persistent connection from Supersimple's IP addresses rather than a connection per query.
  • Only the database address is routed through the tunnel. Routes, default-gateway redirection, and DNS settings pushed by your VPN server are ignored. The tunnel carries nothing but traffic to the database address and port you specify.
  • Supersimple only initiates outbound connections: to your VPN endpoint, and through the tunnel to the database. Nothing connects back to Supersimple.
  • Supersimple sets the tunnel MTU on its own side. You do not need to tune MTU or fragmentation settings on your VPN server.

What to provide ​

  • A dedicated OpenVPN client profile (.ovpn) that can run unattended on Linux and reconnect without interactive authentication. Certificate-based authentication is preferred; a static username and password included with the profile also works. MFA, one-time codes, and SSO logins are not supported. If the profile references separate certificates, keys, or credential files, include those too.
  • The database's private IP address and port. Use an IP address rather than an internal hostname: Supersimple does not use your VPN's DNS, so a name that only resolves inside your network cannot be used. The address should be stable; tell us in advance if it changes.
  • The expiry or rotation policy for the profile's certificates or credentials, so renewals can be coordinated before anything expires.
  • The standard connection details for your database and a dedicated read-only user, as for any other connection. You enter the password directly in Supersimple once the VPN connection is ready.
  • TLS details, if the database enforces TLS: the hostname its certificate is issued for and any private certificate authority that issued it.

Requirements for the VPN profile ​

  • The profile must work with OpenVPN 2.6: modern data ciphers (AES-GCM or ChaCha20-Poly1305), no compression, and no deprecated options. tls-crypt and tls-auth are both supported.
  • Both UDP and TCP transports work. UDP is the usual choice; use TCP if your network restricts UDP.
  • One concurrent session per identity is enough. Do not share the identity with people or other systems: a second login with the same certificate would disconnect Supersimple.
  • Your VPN server must allow the client to reach the database address and port. The database itself must accept connections from the address the VPN server assigns to Supersimple's client.

Network and security ​

  • The VPN identity should be dedicated to Supersimple and, where possible, limited to the database endpoint only.
  • If you restrict access to your VPN endpoint by source IP, allow Supersimple's outbound IP addresses 35.228.195.204 and 35.228.203.89.
  • The database user should be read-only, as with every Supersimple connection.
  • The VPN profile is stored as a secret in Supersimple's infrastructure and is only accessible to the tunnel process serving your account.

Renewing certificates or credentials ​

Send the new profile or credentials to your Supersimple contact before the current ones expire. Swapping the profile causes a brief interruption while the tunnel reconnects; queries issued during those seconds fail with a connection error and can simply be re-run.