All Products
Search

This Product

    DataWorks:Connect to an on-premises data source

    Document Center

    DataWorks:Connect to an on-premises data source

    Last Updated:Mar 26, 2026

    Connect an on-premises data center to DataWorks using Express Connect

    Use this guide if your data source is in an on-premises data center. This example uses a MySQL database to walk through the full setup.

    How it works

    DataWorks accesses your on-premises data source through an Express Connect circuit that links your on-premises network to the Virtual Private Cloud (VPC) attached to your DataWorks resource group. DataWorks initiates the connection — your resource group reaches out through the Express Connect circuit to the database in your data center.

    Network connectivity diagram

    Prerequisites

    Before you begin, ensure that you have:

    Billing

    Express Connect is a paid service. For pricing details, see Billing overview of Express Connect.

    Configure network connectivity

    Before starting, collect the following information — you will need it across multiple steps:

    Information Where to get it
    On-premises data center CIDR block Connect to your data center server, or ask your network administrator or data center provider
    VPC ID of the resource group DataWorks console > Resource Groups > Network Settings (see Step 1)
    vSwitch CIDR block of the resource group DataWorks console > Resource Groups > Network Settings (see Step 1)

    Step 1: Get basic information

    On-premises data center side

    Get the CIDR block of your on-premises data center. If you don't have it, connect to your data center server or ask your network administrator or data center provider.

    DataWorks side

    1. Go to the Resource Groups page in the DataWorks console. Find the target resource group and click Network Settings in the Actions column.

    2. Find the service module that matches your use case. For MySQL data synchronization, locate the Data Scheduling & Data Integration section.

    3. Note the VPC and vSwitch CIDR block shown in that section.

      VPC and vSwitch information

    Step 2: Establish network connectivity

    Connect your on-premises data center to the VPC using an Express Connect circuit. This creates the network path between your on-premises network and the resource group's VPC.

    If you run into issues during this step, submit a ticket to contact technical support for Express Connect.

    Step 3: Add a route to the resource group

    After the Express Connect circuit is active, add a route in the resource group so DataWorks knows how to reach your on-premises CIDR block.

    1. Go to the Resource Groups page in the DataWorks console. Find the target resource group and click Network Settings in the Actions column.

    2. In the relevant service module section, find the bound VPC and click Custom Route in the Actions column.

    3. Click Add Route. Set Connection Method to CIDR block, then enter your on-premises data center CIDR block in the Destination CIDR block field.

    Step 4: (Optional) Configure the IP allowlist

    If your data source restricts access by IP address, add the resource group's vSwitch CIDR block to the data source's IP allowlist.

    The following example shows how to create a dedicated MySQL user account and grant access only from the vSwitch CIDR block.

    1. Log in to the MySQL database as an administrator.

    2. Create a user account for DataWorks and grant the required permissions.

      -- "dataworks_user" is the username. Customize as needed.
-- "StrongPassword123!" is the password. Customize as needed.
CREATE USER 'dataworks_user'@'<the-vSwitch-cidr-block>' IDENTIFIED BY 'StrongPassword123!';

-- Grant access to a specific database (e.g., mydatabase) from the vSwitch CIDR block.
GRANT ALL PRIVILEGES ON mydatabase.* TO 'dataworks_user'@'<the-vSwitch-cidr-block>' WITH GRANT OPTION;

    3. Run FLUSH PRIVILEGES; to apply the changes, then exit the database with exit.

    Step 5: (Optional) Configure the on-premises firewall

    If your data center has a host-based firewall, open the database port for inbound connections from the resource group's vSwitch CIDR block.

    The following example uses firewalld to allow the vSwitch CIDR block to access the MySQL database. Adapt the commands for other firewall software.

    sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<the-vSwitch-cidr-block>" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

    Verify network connectivity

    1. Log in to the DataWorks console. In the top navigation bar, select the target region. In the left-side navigation pane, choose Data Integration > Data Integration. Select your workspace from the drop-down list and click Go to Data Integration.

    2. In the left-side navigation pane, click Data Source. On the data source page, click Add Data Source, select the data source type, and configure the connection parameters.

    3. In the resource group list at the bottom of the page, select the resource group connected to your data source and click Test Network Connectivity.

      Test Network Connectivity

    Troubleshooting

    If the connectivity test returns Failed, check the following common causes before using the Network Connectivity Diagnostic Tool or submitting a ticket:

    Symptom Likely cause Action
    Test fails immediately Route not added in Step 3 Confirm the route pointing to your on-premises CIDR block exists in Custom Route
    Test fails immediately Express Connect circuit not active Verify the circuit status in the Express Connect console
    Test fails with a connection refused error Firewall blocking the database port Check that the vSwitch CIDR block can reach the database port (e.g., 3306 for MySQL)
    Test fails with an authentication error IP allowlist not updated Confirm the vSwitch CIDR block is in the database's IP allowlist (Step 4)
    Test passes but data sync jobs fail Wrong resource group selected Make sure the job uses the resource group configured in this guide