> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rwsintegration.com/llms.txt
> Use this file to discover all available pages before exploring further.

# VPN Connectivity

> Any system behind a VPN is accessible: IPSec site-to-site, OpenVPN, and fixed IPs for allowlisting

Not every source is reachable from the internet, and that is never a blocker: **any system behind a VPN is accessible** to RWS Integration, both for your integrations and for [RWS Connect](/en/core-concepts/rws-connect) pipelines. It does not matter whose system it is: your own, your customer's, or any third party's. Databases, SOAP services and file servers are all reached the same way, through a VPN between RWS and the network where the system lives.

<Info>
  Previews and integrations work perfectly for systems behind a VPN. Once the tunnel is up, the **Extract Preview** panel and your integrations behave exactly as they do with publicly reachable sources.
</Info>

## Supported VPN types

| Type                     | Description                                                                                                                                                   |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **IPSec (site-to-site)** | A permanent tunnel between RWS and the network where the system lives. The usual choice when that network is managed through a firewall or network appliance. |
| **OpenVPN**              | A software-based VPN using client profiles and certificates. A good fit when the network already runs an OpenVPN server.                                      |

## Security

Tunnels are **outbound only**: traffic is always initiated by RWS toward the network where the systems live, never in the other direction. Opening the tunnel gives RWS access to the declared network ranges and nothing else. No system on that network can reach RWS or any other environment through it, guaranteeing security. Combined with the [fixed IP addresses](#ip-allowlisting), the network team always knows exactly who connects and from where.

## IPSec (site-to-site): step by step

1. **Request the VPN** by emailing [connect@rwsintegration.com](mailto:connect@rwsintegration.com) with:

| Item               | Details                                                                                  |
| ------------------ | ---------------------------------------------------------------------------------------- |
| Gateway public IP  | The public IP of the firewall or VPN device that will terminate the tunnel               |
| Device details     | Vendor, model and software version of the firewall, so the configuration file matches it |
| Routing            | Static routing or BGP (include the ASN if BGP; most setups use static routing)           |
| Reachable networks | The internal IP ranges (CIDRs) where the systems live                                    |

2. **RWS sets up its side** and generates a configuration file tailored to the firewall model you informed

3. **You receive the configuration file** with everything the firewall needs: the **two tunnel endpoints**, one pre-shared key per tunnel, and the phase 1 and phase 2 encryption parameters

4. **The network team applies the configuration** to the firewall, setting up both tunnels

5. **We validate together**: with the tunnels up, RWS confirms it can reach the network. Everything works from that moment: go to the application and create your integrations

<Note>
  The configuration always contains **two tunnels for redundancy**. Configure both: if one goes down, traffic fails over to the other automatically and your integrations keep running.
</Note>

## OpenVPN

Much simpler: email [connect@rwsintegration.com](mailto:connect@rwsintegration.com) with the **OpenVPN configuration file** and the **credentials** it needs (certificates, user and password). RWS installs them on its side, and nothing else is required from your team.

## IP allowlisting

All RWS traffic originates from three fixed IP addresses:

```
80.254.212.213
52.44.32.53
52.86.32.5
```

If the source is protected by a firewall but does not require a VPN, allowlisting these three IPs is enough to grant access.

## Requesting and SLA

VPN setup is requested by email to [connect@rwsintegration.com](mailto:connect@rwsintegration.com).

<Info>
  The SLA is **two business days** after the information for your VPN type is provided. Once the VPN is up, systems on that network are immediately usable: go to the application and create your integrations. If you also requested an [RWS Connect](/en/core-concepts/rws-connect) connector for a system on that network, its own SLA of two business days counts from that point.
</Info>

## Next steps

<CardGroup cols={2}>
  <Card title="Network Connectivity" icon="network-wired" href="/en/core-concepts/network-connectivity">
    How RWS reaches any system, anywhere
  </Card>

  <Card title="Databases (JDBC)" icon="database" href="/en/features/connections/databases">
    Extract from databases on private networks
  </Card>

  <Card title="SOAP APIs" icon="file-code" href="/en/features/connections/soap">
    Extract from SOAP services behind a firewall
  </Card>
</CardGroup>