Manage Networking for Confluent Cloud Connectors¶
This topic provides an overview of the networking features supported for fully managed connectors in Confluent Cloud.
Networking¶
Consider the following diagram and the table when determining the public or private networking for fully managed connectors.
For Confluent Cloud networking details, see the Cloud Networking docs.
The following table summarizes networking features supported for fully managed connectors.
| Cluster Networking Type (Cluster Type) | Target System’s Endpoint | Cloud Service Provider | Status |
|---|---|---|---|
| Public Endpoint (Dedicated, Standard, Basic) | Public Endpoint | AWS, Azure, Google Cloud | Supported |
| Private Endpoint | AWS, Azure, Google Cloud | Not supported | |
| VPC/VNet Peering v1 & Transit Gateway v1 (Dedicated) | Public Endpoint | AWS, Azure, Google Cloud | Supported |
Private Endpoint
|
AWS, Azure, Google Cloud | Supported | |
Private Endpoint
|
AWS, Azure | Supported |
|
Private Endpoint
|
Google Cloud | Currently not supported | |
| VPC Peering v2 & Transit Gateway v2 (Dedicated) | Public Endpoint | AWS | Supported |
Private Endpoint
|
AWS | Currently not supported | |
| Private Link (Dedicated) | Public Endpoint | AWS, Azure, Google Cloud | Supported |
Private Endpoint
|
AWS | Supported |
|
Private Endpoint
|
Azure | Supported | |
Private Endpoint
|
Google Cloud | Currently not supported | |
| Private Link (Enterprise) | Public Endpoint | AWS, Azure, Google Cloud | Supported |
Private Endpoint
|
AWS, Azure, Google Cloud | Currently not supported |
Target system networking supportability¶
The following table lists networking supportability of the connectors.
| Target System | Private Link (AWS Dedicated) | Private Link (Azure Dedicated) | Private Link (Google Cloud Dedicated, AWS Enterprise, Azure Enterprise) | Peering / Transit Gateway | Public |
|---|---|---|---|---|---|
| Self-managed Databases (Oracle, Postgres, MS SQL Server, MySQL) | Yes | Yes | Yes only if the endpoint is public | Yes | Yes if publicly accessible |
| RDS | Yes | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes only if the endpoint is public |
| Salesforce | Yes | Yes | Yes if Salesforce is using a private link | Yes | Yes |
| AWS S3 | Yes | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes |
| HTTP | Yes | Yes | Yes only if the endpoint is public | Yes | Yes only if the endpoint is public |
| Snowflake | Yes | Yes | Yes only if the endpoint is public | Yes | Yes |
| MongoDB Atlas | Yes | Yes | Yes only if the endpoint is public | Yes | Yes |
| BigQuery | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes |
| Lambda | Yes if the endpoint is public | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes |
| Opensearch | Yes if the endpoint is public | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes |
| Blob Storage | Yes only if the endpoint is public | Yes | Yes only if the endpoint is public | Yes | Yes |
| Azure SQL | Yes only if the endpoint is public | Yes | Yes only if the endpoint is public | Yes | Yes |
| CosmosDB | Yes only if the endpoint is public | Yes if the endpoint is public Reach out to Confluent if private connectivity is required. |
Yes only if the endpoint is public | Yes | Yes |
| Google Cloud Storage (GCS) | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes |
| BigQuery | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes |
| Google Pub/Sub | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes |
| Google Cloud Functions | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes only if the endpoint is public | Yes | Yes |
| ElasticSearch | Yes | Yes | Yes only if the endpoint is public | Yes | Yes |
| Splunk | Yes | Yes | Yes only if the endpoint is public | Yes | Yes |
The following pages describe how to configure Egress Access Points to connect connectors;
Egress IP address ranges¶
The following tabs provide network connectivity IP address details. Note that a Connect node runs in the same VPC/VNet as the cluster the Connect node was provisioned with. This is true for all cluster types (Basic, Standard, Enterprise and Dedicated). For Confluent Cloud networking details, see the Cloud Networking docs.
Public egress IP addresses are available on all the major cloud platforms. For details, see Public Egress IP Addresses for Confluent Cloud Connectors.
Public egress IP addresses are not supported with Custom Connectors.
The following information applies to a fully managed Sink or Source connector connecting to an external system using a public IP address.
| Cluster network type | Public IP address connectivity | IP range used by the connector |
|---|---|---|
| Public Endpoint | Yes | A set of public egress IP addresses (see Public Egress IP Addresses for Confluent Cloud Connectors) |
| VPC Peering and Transit Gateway | Yes | Dynamic public IP/CIDR range from the cloud provider region where the Confluent Cloud cluster is located |
| Private Link | Yes | Dynamic public IP/CIDR range from the cloud provider region where the Confluent Cloud cluster is located |
The following information applies to a fully managed Sink or Source connector connecting to an external system using a private IP address.
| Cluster network type | Private IP address connectivity | IP range used by the connector |
|---|---|---|
| VPC Peering and Transit Gateway | Yes. DNS Forwarding is required when a private DNS is in use. | The source IP address used is from the /16 CIDR range configured by the customer for the Confluent Cloud cluster |
| Private Link | AWS: Yes using Egress Access Point on AWS [*] Azure: Yes using Egress Access Point on Azure [*] GCP: No |
The IP address of the load balancer which hosts the private link service |
| Public Endpoint | No | N/A |
[*] The price premium will be $0.03/task/hour for Egress Access Points. For more information about Confluent Cloud connector pricing, see Confluent Pricinng.
See the following cloud provider documentation for additional information:
DNS zones¶
The Domain Name System (DNS) is the system used to translate URLs/Hostnames to
IP addresses, for example, www.confluent.io to 54.177.145.149.
A public DNS server contains DNS records that can be resolved using the public internet. A private DNS server contains DNS records that can only be resolved in a private network, such as a VPC or an on-prem environment.
One way to check if a given hostname uses public DNS is running the dig
command with a public DNS resolver:
dig [DNS-server] <hostname>
DNS-server can be any public DNS server, such as Google DNS server
(8.8.8.8) and Cloudflare DNS server (1.1.1.1).
For example:
dig 8.8.8.8 www.confluent.io
Fully managed connectors in Confluent Cloud support the following types of DNS zones/servers for resolving and accessing required endpoints.
| AWS | Azure | Google Cloud | |
|---|---|---|---|
| Public DNS | Supported | Supported | Supported |
| Private DNS | Supported with DNS Forwarding | Supported with DNS Forwarding | Not supported |
Gateway and service endpoints¶
Azure service endpoints and AWS gateway endpoints provide secure and direct private connectivity to Azure and AWS services over the cloud provider network backbone using an optimized route. These endpoints are located in the Confluent Cloud VPC/Vnet.
Managed connector network traffic is routed over cloud service provider secure public endpoints for the following services:
- AWS
- Azure
- Azure Blob Storage
- Azure Cosmos DB
- Azure Event Hubs
- Azure Service Bus
- Microsoft SQL Server
Troubleshoot networking issues for fully managed connectors¶
This page describes common networking-related errors you may encounter when creating connectors, and it provides checklists that can help you to troubleshoot the issues.
Issues with Peering or Transit Gateway¶
Errors trying to connect via FQDN (fully qualified domain name) with publicly resolvable DNS
- If able to directly connect to the private IP address, there is an issue when resolving DNS.
- If not able to connect to the private IP address:
- Check the peering/Transit Gateway setup, routes, associated firewalls, security groups, and network access control lists.
- Check ports and protocol settings.
Errors trying to connect via FQDN with DNS that is not publicly resolvable
- Check if DNS forwarding is correctly set up with the right IP address for the DNS server and is forwarding the needed domain name. For details, see Configure DNS forwarding or Configure DNS forwarding.
- Check your DNS setup, peering/Transit Gateway setup, routes, associated firewalls, security groups, and network access control lists.
- Check ports and protocol settings.
Issues with Private Link¶
Errors related to a private endpoint when directly connecting to a private IP address
- Ensure that the Egress Access Point is correctly set up. For details, see Use AWS Egress Access Points for Dedicated Clusters on Confluent Cloud.
- Check the associated firewalls, security groups, and network access control lists.
- Check ports and protocol settings.
Errors related to a private endpoint when directly connecting to an FQDN
- If the FQDN is publicly resolvable:
- Ensure that the Egress Access Point is correctly set up. For details, see Use AWS Egress Access Points for Dedicated Clusters on Confluent Cloud.
- Check the associated firewalls, security groups, and network access control lists.
- Check ports and protocol settings.
- If the FQDN is not publicly resolvable:
- Ensure that the DNS record is set up for the Egress Access Point. For details, see Create a private DNS record in Confluent Cloud.
- Check the associated firewalls, security groups, and network access control lists.
- Check ports and protocol settings.