--- name: cloud-databases-gen2-private-connections title: Using private endpoints description: '[Gen 2]' last-updated: 2026-06-23 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/cloud-databases-gen2?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Using private endpoints {: #private-endpoints-gen2} [Gen 2]{: tag-purple} Gen 2 Cloud Databases enable a secure by default approach using private connections enabled by Virtual Private Endpoints (VPE). IBM Cloud® uses private endpoints that restrict access to your internal network, protecting your data and applications from unwanted access and security vulnerabilities. Private endpoints also provide greater control over network traffic to your databases for better visibility and enable you to demonstrate adherence to compliance and regulatory requirements. This document covers all of the Gen 2 Cloud Databases: Databases for PostgreSQL and Databases for MongoDB. Setting up Virtual Private Endpoints will incur costs and network transfer charges apply to IBM Cloud VPC services using private endpoints. Charges are based on the volume of data transferred and follow a tiered pricing model. Use the [Cost estimator](https://cloud.ibm.com/estimator) to calculate an estimate based on your projected usage. {: .note} ## Options to connect to your VPC instance via private endpoints {: #methods-privateendpoints} You can access your instance from your local device or non-VPC client via private endpoints. Connect to VPE for VPC to provide a secure connectivity to services and instances originating from your VPC network. The instructions to connect to your Gen 2 (VPC) instance depend on where you're connecting from and where your application is running. 1. VPE via VSI - This method uses a Virtual Server Instance (VSI) that resides in your Virtual Private Cloud (VPC) and leverages the Virtual Private Endpoint (VPE) to provide secure, private connectivity between resources within the VPC and external IBM Cloud services. 1. Use VPN connection established through a VPE (Client to Site). The VPN lets you connect and manage from a local laptop or client via the VPC/VPE. For more information, see [Client to Site](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview&format=markdown). 1. Use a VPC/VPN gateway for secure and private on-premises access to cloud resources. For more information, see [Site to Site](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-site2site-vpn&format=markdown). ## Establishing Virtual Private Endpoints through a VSI {: #howto-privateendpoints} ### Step 1: Create a VPC {: #howto-privateendpoints-vsi1} Use IBM Cloud instructions to [create a Virtual Private Cloud (VPC)](https://cloud.ibm.com/infrastructure/network/vpcs). Ensure that the VPC is in the same region as your database deployment. ### Step 2: Create a VSI and an SSH key {: #howto-privateendpoints-vsi2} 1. Provision a VSI within the VPC using [instructions for creating virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=ui&format=markdown) in the [Virtual server instances for VPC UI](https://cloud.ibm.com/infrastructure/compute/vs). Assign a floating IP to the VSI to allow external SSH access (optional for testing). 2. Generate and attach an SSH key for secure login. For detailed instructions on how to create an SSH key pair, see [Getting started with SSH Keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&interface=ui&format=markdown). 3. Once the key pair is ready, move the private key into the `~/.ssh` directory on your local machine to follow best practises for secure SSH key management. 4. Change the permissions of the private key. This makes the key read-only to the file owner. On Unix-like systems such as macOS, run the following command: `$ chmod 400 ~/.ssh/` 5. SSH into your VSI using the following command: `$ ssh -i ~/.ssh/ root@` ### Step 3: Create a VPE {: #howto-privateendpoints-vsi3} In the IBM Cloud console, click the menu icon and select **VPC Infrastructure > Network > Virtual private endpoint gateways**. Create a VPE for your Cloud Databases instances with [these instructions](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown). Bind the VPE to your VPC and subnet. ### Step 4: Update VPC security groups {: #howto-privateendpoints-vsi4} Modify the security group to allow outbound traffic from your VSI to the database instance. Ensure ports required by your database (for example, Postgresql or MongoDB) are open. ### Step 5: Create a service key for your database {: #howto-privateendpoints-vsi5} Use IBM Cloud CLI or UI to create a service key for the database. The service key contains the information that is needed to access the database. ### Step 6: Connect to your database with private endpoints {: #howto-privateendpoints-vsi8} Install and verify the required database client, and connect to the database using the connection details from the service key. This command will vary depending on the database. The instructions required per database are listed in the table below. | Service | Client tool | Sample command | |-----------------------------|------------------|-------------------------------------------------------------------------------------| | Databases for PostgreSQL | `psql` | You can connect to the VSI from a local environment by sending the root certificate from a local machine to a VSI.`$ PGPASSWORD=$PASSWORD psql “` You can verify your connection with the following command (optional):`$ /list` | | Databases for MongoDB | `mongosh` | You can verify your connection with the following command:`--eval "db.stats()"` | {: caption="Client tools and example connection commands for private access" } ## Establishing Virtual Private Endpoints using a VPN connection {: #howto-privateendpoints-vpn} Use a VPN to connect to a VPC and access a VPE. The VPN lets you connect and manage your instance from a local laptop or client via the virtual private endpoint in your VPC. ### Step 1: Create a VPC {: #howto-privateendpoints-vpn1} Use IBM Cloud instructions to [create a Virtual Private Cloud (VPC)](https://cloud.ibm.com/infrastructure/network/vpcs). Ensure the VPC is in the same region as your database deployment. ### Step 2: Create a VPE {: #howto-privateendpoints-vpn2} 1. In the IBM Cloud console, click the menu icon and select **VPC Infrastructure > Network > Virtual private endpoint gateways**. Create a VPE for your Cloud Databases instances with [these instructions](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown). 1. Bind the VPE to your VPC and subnet. ### Step 3: Update VPC security groups {: #howto-privateendpoints-vpn3} Modify the security group to allow outbound traffic from your VSI to the database instance. Ensure ports required by your database (for example, Postgresql or MongoDB) are open. ### Step 4: Create the VPN server {: #howto-privateendpoints-vpn4} 1. Create an IBM Cloud [secrets manager instance](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui&format=markdown). 1. Create a certificate engine in secrets mananger and generate a certificate for the VPN server. 1. Create IAM service to service authorisation for the VPN server to secrets manager to enable the VPN server to securely retrieve the certificate. 1. Create a VPN server for VPC, specifying the VPC created in step 1. Configure it to use the certificate stored in secrets manager. You have now set up a VPN server that allows you to establish a secure tunnel to the VPC. ### Step 5: Connect to the VPN {: #howto-privateendpoints-vpn5} Download the VPN client file and use a VPN client to connect to the VPN. ### Step 6: Connect to your database with private endpoints {: #howto-privateendpoints-vpn7} | Service | Client tool | Sample command | |-----------------------------|------------------|-------------------------------------------------------------------------------------| | Databases for PostgreSQL | `psql` | You can verify your connection with the following command:`$ /list` | | Databases for MongoDB | `mongosh` | You can verify your connection with the following command:`--eval "db.stats()"` | {: caption="Client tools and example connection commands for private access via VPN" } ## Establishing VPC/VPN gateway from on-premise {: #howto-privateendpoints-site2site} Use a VPC/VPN gateway for secure and private on-premises access to cloud resources. ### Step 1: Create a VPC {: #howto-privateendpoints-vpn1} Use IBM Cloud instructions to [create a Virtual Private Cloud (VPC)](https://cloud.ibm.com/infrastructure/network/vpcs). Ensure the VPC is in the same region as your database deployment. ### Step 2: Create a VPE {: #howto-privateendpoints-vpn2} 1. In the IBM Cloud console, click the menu icon and select -> VPC Infrastructure -> Network -> Virtual private endpoint gateways. Create a VPE for your Cloud Databases instances with [these instructions](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown). 1. Bind the VPE to your VPC and subnet. ### Step 3: Update VPC security groups {: #howto-privateendpoints-vpn3} Update security groups with rules to allow traffic between the VPN and Gateway and VPE. ### Step 4: Build your connection by creating a VPN {: #howto-privateendpoints-vpn4} 1. Create a VPN Gateway in the VPC. 2. Use [strongSwan](https://www.strongswan.org/), a popular VPN Gatewayto simulate an on-premise VPN Gateway. 3. Configure DNS resolution to route queries through IBM Cloud DNS resolver. ### Step 5: Log in to the network {: #howto-privateendpoints-site2site5} Log in to the network by connecting through the VPN. When the service-to-service VPN is active, the secure connection path works automatically, allowing access to the on-premise VSI and cloud bastion host. ### Step 6: Connect to your database with private endpoints {: #howto-privateendpoints-vpn7} Connect to your database from an on-premise location by installing and verifying the required client. The clients for each database and sample verification commands are shown in the following table: | Service | Client tool | Sample command | |-----------------------------|------------------|-------------------------------------------------------------------------------------| | Databases for PostgreSQL | `psql` | You can verify your connection with the following command (optional):`$ /list` | | Databases for MongoDB | `mongosh` | You can verify your connection with the following command:`--eval "db.stats()"` | {: caption="Client tools and example connection commands for private access via VPN" }