Azure Private Link

1. Verify that your destination supports Private Endpoint. For more information, see Microsoft documentation.
2. Open a Fivetran support ticket and provide your Azure-hosted service’s fully-qualified resource ID, including the resource name and resource type of your destination.
3. Wait to receive Private Endpoint request details from Fivetran. We create a Private Endpoint using your resource ID, type, and subresource. We then initiate a Private Link connection request as part of the Private Endpoint setup and share the details of that request with you.
4. In the Azure Portal or CLI, verify and approve the Private Link connection request from Fivetran. Once you approve the request, Fivetran completes the Private Link setup for your Azure-hosted service.

Depending on whether or not your destination already has an Azure Private Link Service, do one of the following:

• If your destination is already configured with a Private Link Service, follow the setup instructions for Azure-hosted destinations.
• If your destination does not have a Private Link Service, set up the service and then follow the setup instructions for Azure-hosted destinations. For more information about setting up a Private Link Service, see the Setup instructions for Private Link Service section of this documentation.

Prerequisites

To set up Private Link Service, you must do the following:

• Configure a VNet with access to your destination.
• Ensure that your destination is accessible from the VNet where the Private Link Service Load Balancer will run.

Setup instructions

1. In the VNet, create a Standard Load Balancer with a NIC-based backend pool that has access to your destination.

2. Configure a health probe and a load balancer rule with the ports that your destination will use. For more information, see Azure's documentation.

3. Create a Private Link Service associated with the Standard Load Balancer you created in step 1. For more information, see Azure's documentation.

4. Create one or more Virtual Machines and place them in the backend pool of the load balancer you created in step 1.

5. Enable IP forwarding on each of the backend Virtual Machine network interfaces. For more information about how to enable IP forwarding, see Azure's documentation.

6. For security reasons, ensure that no public IP addresses are configured for the Virtual Machines. Private Link connections use only private IP addresses.

7. Log in into each backend Virtual Machine of the Load Balancer and run the script below. The script configures Network Address Translation (NAT), which forwards network packets from SLB-backend Virtual Machines to your destination. The script also configures a single port forwarding. However, you can add additional sets of iptables PREROUTING and POSTROUTING rules for additional ports.

   #!/bin/bash
   
   # This script configures Network Address Translation to forward incoming packets
   # from the Azure Standard Load Balancer to IP-based destinations and route them
   # back. In this script, "destination" means a destination server that Fivetran connects to.
   
   # local port where Load Balancer sends traffic to
   SOURCE_PORT=<local_port>
   # destination server inside internal network
   DESTINATION_IP=<destination_server_ip_address>
   DESTINATION_PORT=<destination_server_port>
   
   # enable IP forwarding on host
   echo 1 > /proc/sys/net/ipv4/ip_forward
   
   # clear existing iptables rules and chains
   iptables -F
   iptables -t nat -F
   iptables -X
   
   # change the packet recipient from local to destination socket (host & port)
   iptables -t nat -A PREROUTING -p tcp --dport ${SOURCE_PORT} -j DNAT --to-destination ${DESTINATION_IP}:${DESTINATION_PORT}
   
   # change the source IP address from the LB NAT IP address to the IP of this LB-backend host
   iptables -t nat -A POSTROUTING -p tcp -d ${DESTINATION_IP} --dport ${DESTINATION_PORT} -j SNAT --to-source $(hostname -i)
   

Find resource ID

1. Verify that your destination supports Private Endpoint. For more information, see Microsoft’s documentation.
2. Log in to the Azure portal and then go to your Azure-hosted service.
3. Select your workspace and then go to Properties.
4. Make a note of the Resource ID. You will need it to create the Private Link connection.

Configure Private Link connection

1. Log in to the Fivetran dashboard and go to the destination setup form.

2. In the Connection Method drop-down menu, select Connect via Private Networking.

3. Click + Configure a new PrivateLink connection.

4. Enter a Name for your Private Link connection.

5. In the PrivateLink Resource ID field, enter the resource ID you found in Step 1.

6. In the PrivateLink Subresource name drop-down menu, select the subresource corresponding to your resource type. The following table lists the subresources corresponding to each resource type:

   Resource Type	Subresource
   Azure SQL Managed Instance	managedInstance
   Azure SQL Database	sqlServer
   Azure Blob Storage (Azure Storage)	blob, dfs
   Azure Service Bus	namespace
   Azure PostgreSQL Database	postgresqlServer
   Azure Cosmos DB	sql
   Azure Mongo DB	MongoDB

7. Click Create and save. Fivetran will raise a connection request in Azure.

   It might take up to 10 minutes for us to raise the connection request.

Accept connection request

1. Go to your Azure account.
2. Go to Private Link Center > Pending connections.
3. Select the connection request from Fivetran, and click Approve.
4. In the pop-up window, confirm that you want to approve the connection request. Once Azure processes the request, a Connection created will appear in your destination setup form.