Depending on the networking configuration of your upstream data source, you can connect ClickPipes using the following approaches:
IP allowlisting
For data sources exposed to the public internet, you can use IP allowlisting to restrict traffic to the static NAT IPs ClickPipes connects from. Add the static NAT IPs for the region that ClickPipes connects from to the upstream firewall or security group rules.
Managed private endpoints
For data sources that are not exposed to the public internet, you can connect using managed private endpoints. ClickPipes creates a reverse private endpoint (RPE) in its VPC and points it at a private endpoint service published for your data source, so traffic is never exposed to the public internet.
Support for RPE depends on the cloud provider and region your data source is hosted in:
SSH tunneling
For data sources that are not exposed to the public internet and can’t use managed private endpoints, you can connect
using an SSH tunnel via a bastion host. Add the static NAT IPs for the region that ClickPipes connects from to the firewall rules of the upstream bastion host.
You should use this approach when:
- The data source is hosted on Azure.
- The data source and ClickPipes are hosted in different cloud providers or regions, and there is no option for cross-region connectivity with managed private endpoints.
- There is no option to use managed private endpoints, e.g. on-premises deployments that can only be reached through a bastion host.
Last modified on July 30, 2026
