Private Networks (VPN)

Powered by Tailscale

Need to integrate with ERP systems, databases, or APIs hosted in-house or on restricted cloud infrastructure? Retrieve seamlessly connects to private servers that aren't exposed to the public internet through secure VPN technology powered by our partner, Tailscale.

What is Tailscale?

Tailscale is a modern VPN built on WireGuard® that creates secure point-to-point connections between your devices. Unlike traditional VPNs that route all traffic through a central server, Tailscale establishes direct encrypted connections between devices.

How It Works

Retrieve uses Tailscale to create a secure connection between your dedicated integration server and your private network:

Setup Guide

Prerequisites

• A Tailscale account (free for up to 100 devices)
• Access to the server/machine you want to connect to Retrieve
• Basic command-line knowledge (for installation)

Step 1: Install Tailscale on Your Private Server

Visit tailscale.com/download and follow the installation instructions for your operating system.

Linux Installation

curl -fsSL https://tailscale.com/install.sh | sh
# Follow the on-screen instructions to authenticate

Windows Installation

Download the Tailscale Windows installer and run it. Follow the setup wizard.

macOS Installation

brew install tailscale
sudo tailscale up

Or download from the Mac App Store.

Docker Installation

docker run -d \
  --name=tailscale \
  --restart=unless-stopped \
  --network=host \
  -v /var/lib/tailscale:/var/lib/tailscale \
  tailscale/tailscale:latest \
  tailscaled --state=/var/lib/tailscale/tailscaled.state

Step 2: Authenticate Tailscale

After installation, authenticate with your Tailscale account:

sudo tailscale up
# Opens browser for authentication

This will open a browser window where you can log in to your Tailscale account and authorize the device.

Step 3: Generate an Auth Key

To connect Retrieve to your Tailscale network, you need to generate a reusable auth key:

1. Log in to the Tailscale admin console
2. Navigate to Settings → Keys
3. Click Generate auth key
4. Configure the key settings:
   • ✅ Reusable - Check this box (allows Retrieve to reconnect)
   • ✅ Ephemeral - Optional (device is removed when it disconnects)
   • ⏰ Expiration - Set to 90 days (Retrieve will notify you before expiration)
   • 📝 Description - e.g., "Retrieve Integration Server"
5. Click Generate key and copy it

Step 4: Add Auth Key to Retrieve

In your Retrieve application:

1. Navigate to Settings → VPN
2. Click Add Tailscale Connection
3. Paste your auth key
4. Click Connect

Retrieve will now join your Tailscale network and establish a secure connection to your private resources.

Step 5: Verify the Connection

To verify that Retrieve successfully joined your Tailscale network:

1. Go to the Tailscale admin console → Machines
2. Look for a device named retrieve-{your-app-id}
3. Check that it shows as "Connected"
4. Note its Tailscale IP address (e.g., 100.x.x.x)

Common Use Cases

Use Case 1: Private MySQL Database

Scenario: Your company's ERP system runs on a MySQL database in your office, not accessible from the internet.

Setup:

1. Install Tailscale on the MySQL server (or a machine that can access it)
2. Connect Retrieve to your Tailscale network
3. Create integration using the MySQL server's private IP: 10.0.0.5:3306

{
  "host": "10.0.0.5",
  "port": 3306,
  "database": "erp_database",
  "user": "retrieve_user",
  "password": "secure_password"
}

Use Case 2: On-Premise REST API

Scenario: Custom ERP system exposes a REST API on your internal network at http://192.168.1.50/api

Setup:

1. Install Tailscale on a server within your office network
2. Connect Retrieve to Tailscale
3. Configure integration to use the private API endpoint

// Use private API endpoint in integration
const response = await fetch('http://192.168.1.50/api/orders', {
  headers: {
    'Authorization': 'Bearer YOUR_TOKEN'
  }
});

const orders = await response.json();

Use Case 3: Port Forwarding for Restricted Servers

Scenario: You can't install Tailscale directly on your database server due to IT restrictions.

Solution: Use port forwarding from another machine on the same network:

1. Install Tailscale on a separate machine (e.g., a Linux VM) that can access the database
2. Set up port forwarding on that machine to proxy connections to the database
3. Retrieve connects to the proxy machine via Tailscale

# On the proxy machine (has Tailscale installed)
# Forward local port 3306 to database server
ssh -L 3306:192.168.1.10:3306 -N -f user@localhost

# Retrieve connects to: 100.x.x.x:3306

Now Retrieve can connect to 100.x.x.x:3306 (the proxy machine) which forwards to 192.168.1.10:3306 (the database).

Security Considerations

Tailscale Security Model

Tailscale implements a zero-trust network architecture:

• Device Authentication - Every device must authenticate with your Tailscale account
• End-to-End Encryption - All connections use WireGuard encryption (ChaCha20-Poly1305)
• No Central Server - Traffic flows directly between devices (peer-to-peer when possible)
• Access Control Lists - Define which devices can access which resources
• Audit Logs - See all connection attempts and network activity

Best Practices

Troubleshooting

Common Issues and Solutions

Advanced Configuration

Subnet Routing

Instead of installing Tailscale on every private server, you can configure one machine as a subnet router to expose entire networks:

# On the subnet router machine
sudo tailscale up --advertise-routes=192.168.1.0/24

# Approve in Tailscale admin console
# Now all devices on 192.168.1.0/24 are accessible

This allows Retrieve to access all devices on the 192.168.1.0/24 network through a single Tailscale connection.

MagicDNS for Easy Hostname Access

Enable MagicDNS in your Tailscale settings to use hostnames instead of IP addresses:

• Go to Tailscale admin → DNS
• Enable MagicDNS
• Devices are accessible by name: mysql-server instead of 100.x.x.x

{
  "host": "mysql-server",
  "port": 3306,
  "database": "erp_database"
}

Access Control Lists (ACLs)

Restrict which devices can access specific resources using Tailscale ACLs:

{
  "acls": [
    {
      "action": "accept",
      "src": ["tag:retrieve"],
      "dst": ["tag:database:3306"]
    }
  ],
  "tagOwners": {
    "tag:retrieve": ["your-email@company.com"],
    "tag:database": ["your-email@company.com"]
  }
}

This ACL allows only the Retrieve server to access MySQL on port 3306.

Pricing & Limits

Tailscale offers generous free and paid plans. See Tailscale's pricing page for current details.

Alternatives to Tailscale

While Retrieve officially partners with Tailscale, you can technically use other VPN solutions if needed:

However, we strongly recommend Tailscale for its ease of use, security, and performance. Our integration is optimized for Tailscale.

Learn More

Next Steps

• Integrations - Learn how to use private network connections in your integrations
• Architecture - Understand how VPN fits into Retrieve's infrastructure
• Quick Start - Configure your first integration with private network access