> For the complete documentation index, see [llms.txt](https://doc.wearepatchworks.com/product-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.wearepatchworks.com/product-documentation/getting-started/subscription-tier-limits/vpn-options.md).

# VPN options

## Overview

Some integrations require Patchworks to reach resources that aren't accessible over the public internet - such as internal ERP systems, on-premise databases, or private APIs behind a corporate firewall. VPN options give you a secure, dedicated tunnel between Patchworks' infrastructure and your network.

Two tiers are available, depending on whether you need to run **custom scripts** that also require VPN access:

### Connector + Scripts

**Full VPN access**

VPN access for both connectors and custom scripts that need to reach private network resources.

**Includes**

* ✓ Connector access to VPN resources
* ✓ Custom script access to VPN resources
* ✓ Node group(s)
* ✓ Dedicated customer queue (push/pull)
* ✓ Dedicated subnet(s)
* ✓ AWS Site-to-Site VPN tunnel

### Connector only

**Connector VPN access**

VPN access scoped to connectors only. Custom scripts continue to run on the shared infrastructure.

**Includes**

* ✓ Connector access to VPN resources
* ✗ Custom scripts (shared queue)
* ✓ Node group
* ✓ Dedicated customer queue (push/pull)
* ✓ Dedicated subnet(s)
* ✓ AWS Site-to-Site VPN tunnel

{% hint style="info" %}
Both options give your company its own **node group(s)**, providing entirely dedicated, separated traffic. Push/pull jobs also run on a **dedicated customer queue**. Custom scripts are an exception - they use the shared queue in both tiers.
{% endhint %}

## How it works

Both VPN tiers are built on **AWS Site-to-Site VPN**, which creates an encrypted IPsec tunnel between your network and the dedicated Patchworks VPC (Virtual Private Cloud) provisioned for your company.

[🔗AWS Site-to-Site VPN — official documentation docs.aws.amazon.com](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html)

At a high level, the provisioning process works like this:

```
Your network

──── IPsec tunnel ────

AWS VPN gateway

→

Customer VPC

Inside the Customer VPC

New subnet(s)

→

Node group(s)

→

Dedicated queue
```

### Dedicated infrastructure

Unlike standard Patchworks tenancy - where node groups and queues are shared across customers - VPN customers receive:

* **A new set of subnets** provisioned per customer inside the AWS VPC
* **A dedicated node group** (or multiple, depending on your workload) - ensuring your traffic is never co-mingled with other customers
* **A dedicated push/pull queue** - so inbound and outbound events are isolated end-to-end

{% hint style="info" %}
Custom scripts run on a **shared script queue** in both tiers. If your custom scripts also need to reach private network resources, you need the **Connector + Scripts** tier
{% endhint %}

## Tier comparison

| Feature                               | Connector only       | Connector + Scripts  |
| ------------------------------------- | -------------------- | -------------------- |
| Connector access to VPN resources     | ✓ Yes                | ✓ Yes                |
| Custom script access to VPN resources | ✗ No                 | ✓ Yes                |
| Dedicated node group(s)               | ✓ Yes                | ✓ Yes                |
| Dedicated push/pull queue             | ✓ Yes                | ✓ Yes                |
| Dedicated subnets (per customer)      | ✓ Yes                | ✓ Yes                |
| VPN technology                        | AWS Site-to-Site VPN | AWS Site-to-Site VPN |

* The current implementation uses **AWS Site-to-Site VPN**.
* Final pricing will be confirmed during customer review.
* Setup requires coordination with your network team to configure the VPN tunnel from your side.

## Getting started

VPN connectivity is set up on a per-customer basis by the Patchworks team. To get started:

{% stepper %}
{% step %}

## Contact Patchworks

Contact your Patchworks account manager or reach out via **support** to express interest.
{% endstep %}

{% step %}

## Share network resource details

Share details about the network resources that Patchworks needs to reach (endpoints, protocols, ports).
{% endstep %}

{% step %}

## Configure the customer-side VPN endpoint

Your network team will need to configure the customer-side VPN endpoint - Patchworks will provide the AWS VPN gateway details.
{% endstep %}

{% step %}

## Provision dedicated infrastructure

Patchworks provisions your dedicated subnets, node group(s), and queue.
{% endstep %}

{% step %}

## Test connectivity

Connectivity is tested end-to-end before go-live.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
There is no self-service setup for VPN connectivity. All provisioning is handled by the Patchworks infrastructure team in coordination with your network administrators.
{% endhint %}