Supersimple

Appearance

Connect a data warehouse through OpenVPN ​

Supersimple can connect to a supported private database or data warehouse through OpenVPN, without exposing the database to the internet.

Contact Supersimple to get started.

How it works ​

  • Supersimple keeps one persistent VPN session open and reconnects automatically.
  • Only the database IP address and port are routed through the tunnel.
  • Connections are outbound: to your VPN endpoint, then to the database through the tunnel.

What to provide ​

  • A dedicated OpenVPN client profile (.ovpn) that can run unattended on Linux and reconnect without interactive authentication. Certificate-based authentication is preferred; a static username and password included with the profile also works. MFA, one-time codes, and SSO logins are not supported. If the profile references separate certificates, keys, or credential files, include those too.
  • The database's private IP address and port. Use a stable IP address rather than an internal hostname. Tell Supersimple in advance if the address changes.
  • Certificate or credential expiry dates and rotation requirements.
  • The standard connection details for your database and a dedicated read-only user, as for any other connection. You enter the password directly in Supersimple once the VPN connection is ready.
  • TLS details, if the database enforces TLS: the hostname its certificate is issued for and any private certificate authority that issued it.

Requirements for the VPN profile ​

  • The profile must work with OpenVPN 2.6: modern data ciphers (AES-GCM or ChaCha20-Poly1305), no compression, and no deprecated options. tls-crypt and tls-auth are both supported.
  • Both UDP and TCP transports work.
  • One concurrent session per identity is enough. Do not share the identity with people or other systems: a second login with the same certificate would disconnect Supersimple.
  • Your VPN server must allow the client to reach the database address and port. The database itself must accept connections from the address the VPN server assigns to Supersimple's client.

Network and security ​

  • The VPN identity should be dedicated to Supersimple and, where possible, limited to the database endpoint only.
  • If you restrict access to your VPN endpoint by source IP, allow Supersimple's outbound IP addresses 35.228.195.204 and 35.228.203.89.
  • The VPN profile is stored as a secret in Supersimple's infrastructure and is only accessible to the tunnel process serving your account.

Renewing certificates or credentials ​

Send the new profile or credentials to your Supersimple contact before the current ones expire. Replacing the profile briefly interrupts queries while the tunnel reconnects.