Start free trialBook a demo
Menu
Start free trialBook a demo
UnpackData Docs

Connection guide

Your workspace connects to your databases over the internet. If a database is behind a firewall, allow your workspace's IP address so the connection gets through. This guide shows where to find the address, how to allow it in the most common places, and how each type of database encrypts the connection.

Which address to allow

Your workspace connects from one IP address. Admins can find it in two places:

  • Manage Settings › Site, in the IP Address field.
  • The IP Address panel on the Connections page, above Sample Connection Strings. Copy puts the address on your clipboard.

Allow only that address, and only on your database's port:

DatabasePort
Microsoft SQL Server1433, unless your server uses another
OracleThe port in your Data Source, often 1521
PostgreSQL5432
MySQL3306

Azure SQL Database

  1. In the Azure portal, open your SQL server: the server, not one of its databases.
  2. Under Security, select Networking.
  3. Under Public access, choose Selected networks.
  4. Under Firewall rules, select Add a firewall rule. Name it UnpackData, and enter your workspace's address as both the Start IP and the End IP.
  5. Select Save.

For Azure SQL Managed Instance:

  1. Turn on its public endpoint.
  2. Allow your workspace's address on port 3342 in the instance's network security group.
  3. In UnpackData, enter the public endpoint's host name followed by ,3342 in Server / Data Source.

For Azure Database for PostgreSQL or MySQL, open the server's Networking page and add a firewall rule with your workspace's address as the start and end IP. Then save.

Amazon RDS

  1. In the Amazon RDS console, open your database and select the Connectivity & security tab.

  2. Check that Publicly accessible is Yes. If it's No, which is the default for a new database:

    1. Select Modify.
    2. Under Connectivity, open Additional configuration and choose Publicly accessible.
    3. Select Continue, choose Apply immediately, then select Modify DB instance.

    This works only if the database's subnets can reach the internet. If they can't, see When the database can't be reached from the internet.

  3. Under Security, select the database's VPC security group.

  4. On the Inbound rules tab, select Edit inbound rules, then Add rule.

  5. Fill in the rule:

    • Type: your database engine, for example MSSQL, Oracle-RDS, PostgreSQL or MYSQL/Aurora. If your database uses another port, choose Custom TCP and enter that port.
    • Source: Custom, with your workspace's address followed by /32, for example 203.0.113.10/32.
    • Description: UnpackData.

  6. Select Save rules.

Other cloud databases

Oracle Autonomous Database (Oracle Cloud):

  1. Open your database in the Oracle Cloud console.
  2. Under Network, select Edit next to Access control list. Add your workspace's address as an IP address, then save.
  3. Under Network, select Edit next to Mutual TLS (mTLS) authentication. Clear Require mutual TLS (mTLS) authentication, then save. By default the database only accepts connections that use a wallet file; this lets your workspace connect without one.
  4. Select Database connection, set TLS authentication to TLS, and copy a connection string into Data Source in UnpackData.

These TLS connection strings, like the Oracle sample on the Connections page, only work from addresses on the access list.

Google Cloud SQL:

  1. Open your instance and select Connections, then the Networking tab.
  2. Make sure Public IP is turned on.
  3. Under Authorized networks, select Add a network. Enter a name such as UnpackData and your workspace's address, then select Done and Save.

If you require encrypted connections on the Security tab, choose Allow only SSL connections. Your workspace can't connect when the instance requires trusted client certificates.

Your office or data center

For a database on your own network:

  1. On your firewall or router, allow incoming connections from your workspace's address to the database port, and forward that port to the database server.
  2. On the database server, allow the same port from your workspace's address in its own firewall. On Windows, that's an inbound rule in Windows Defender Firewall.
  3. SQL Server only:
    • In SQL Server Configuration Manager › SQL Server Network Configuration › Protocols for your instance, enable TCP/IP, then restart the SQL Server service.
    • A named instance picks a new port each time it starts. Give it a fixed one in the TCP/IP properties, on the IP Addresses tab under IPAll.
    • Enter the server as host,port in Server / Data Source, for example db.example.com,1433.

In UnpackData, enter the database server's public host name or IP address, not its name on your internal network.

Encryption

How each type of database protects the connection between your workspace and the database:

  • Microsoft SQL Server: the connection form has no encryption setting, so the connection is encrypted when the server requires it.
    • Azure SQL Database and Azure SQL Managed Instance encrypt every connection.
    • Amazon RDS: set rds.force_ssl to 1 in the database's parameter group, then reboot the database. A default parameter group can't be changed, so create one for your SQL Server edition and attach it first.
    • Google Cloud SQL: on Connections › Security, choose Allow only SSL connections.
    • Your office or data center: in SQL Server Configuration Manager › SQL Server Network Configuration, open the properties of Protocols for your instance. On the Flags tab, set Force Encryption to Yes, then restart the SQL Server service. On SQL Server 2022 and later, leave Force Strict Encryption at No: your workspace can't connect when it's on.
  • Oracle: the Data Source you enter decides. A Data Source that contains protocol=tcps is encrypted, as Oracle Cloud's connection strings and the sample on the Connections page are. For your own Oracle server, use its TCPS listener, or ask your database administrator to require Oracle's network encryption.
  • PostgreSQL: choose in the Encryption setting.
    • Required, the default: always encrypted. The connection fails if the server doesn't offer encryption.
    • Use if the server supports it: encrypted whenever the server offers it.
    • Off: not encrypted. Avoid it for a database reached over the internet.
  • MySQL: the connection is encrypted whenever the server supports it, as Amazon RDS, Azure and most MySQL servers do. To make sure, turn on the server's require_secure_transport setting.

When the database can't be reached from the internet

If your database has no public address, your workspace can't connect to it yet. This is the case, for example, when it's only on your office network or only reachable through a VPN. For now you can:

  • give the database a public address that only your workspace's IP address can reach, as in the sections above;
  • or bring the data in with Excel upload.

Questions about your setup? Email [email protected].