On-Premises Connector

The On-Premises Connector connects 9brains via an encrypted connection with systems in your company network: databases, ERP systems, file servers or other internal services.

The connector is protocol-agnostic, anything reachable via TCP works: databases, HTTP APIs, SMB file servers, LDAP and more.

There are two connection routes, both lead to the same result:

• Firewall connection (WireGuard), described on this page. Suitable when your firewall supports WireGuard.
• Connector software in your network, a small piece of software on a device in your network. Ideal when your firewall does not support WireGuard or you only want to make a single machine reachable. No firewall configuration, no open port required.

Typical use cases:

• SQL queries against an internal PostgreSQL, MySQL or MS SQL database (via an integration or a skill)
• API calls to an internal ERP such as Odoo, SAP or Microsoft Dynamics (via a skill)
• Index files from an internal file server, NAS or SMB share (as a data source)
• Access to internal web applications such as Grafana or BI dashboards
• Connect your own tools that are reachable via TCP, in combination with a custom skill

Important: The On-Premises Connector establishes the network connection. For the AI to actively use an internal system, you additionally need a matching integration (e.g. PostgreSQL) or a skill that interacts with the system.

Note on file servers and NAS: For files there is a shorter route. An internal file server, a NAS or an SMB share can be connected directly as a data source, so the files are indexed automatically and become searchable in the chat. All you need for that is a service with protocol SMB in this connector, no custom skill.

Requirements

• You are an administrator in the workspace
• Your workspace has a Business or Max license
• Your firewall supports WireGuard (pfSense, OPNsense, Sophos, Fortinet, Unifi, MikroTik or similar)
• A UDP port on the firewall is reachable from the outside (default: 51820)

No WireGuard on the firewall? Use the connector software in your network instead. For that you need neither WireGuard nor an open port.

How it works

Your company network                         9brains Cloud
┌──────────────────────┐                    ┌──────────────────────┐
│                      │   WireGuard tunnel │                      │
│  Database ───────────│═══════════════════►│── Integration/Skill  │
│  ERP system ─────────│═══════════════════►│── Code execution     │
│  File server ────────│═══════════════════►│── Data indexing      │
│                      │    (encrypted)     │                      │
└──────────────────────┘                    └──────────────────────┘

1. You configure a WireGuard tunnel between your firewall and 9brains
2. You set up services, each service points to an internal system (e.g. database on port 5432)
3. You set up an integration or a skill that uses the service
4. The AI can address the system through the encrypted tunnel

Important: The connection is outbound only, 9brains connects to your systems. Your network cannot initiate connections to us.

Create a tunnel

1. Go to Settings → On-Premises Connector
2. Click “Create tunnel”
3. Fill in the fields:

Field	Description
Name	A meaningful name (e.g. “Main site Munich”)
Endpoint	The public address of your firewall with the WireGuard port (e.g. vpn.mycompany.com:51820)
Peer Public Key	The WireGuard public key of your firewall, found in the WireGuard configuration of your firewall

4. Click “Save”
5. A public key is displayed, you need to enter this as a peer in your firewall

Configure the firewall

Add a new peer in the WireGuard configuration of your firewall:

Field	Value
Public Key	The displayed public key from 9brains (copy button)
Allowed IPs	The displayed tunnel IP (e.g. 10.0.0.2/32)
Endpoint	Not required, 9brains initiates the connection

Note: The exact configuration varies depending on the firewall vendor. Check your firewall’s documentation for the WireGuard peer configuration.

Add services

A service describes a specific system that is reachable through the tunnel.

1. Open the tunnel in the detail view
2. Click “Add service”
3. Fill in the fields:

Field	Description
Name	Display name (e.g. “ERP database”)
Remote host	The internal IP or the hostname of the target system (e.g. 192.168.10.5)
Remote port	The port of the target system (e.g. 5432 for PostgreSQL)
Protocol	Type of service (PostgreSQL, HTTP, SMB, LDAP etc.)
Description	What does this system contain? The AI sees this information in the chat

4. Click “Save”
5. An assigned address is displayed. For a skill you enter it as the endpoint; for integrations and data sources you pick the service below instead, and the address is set for you

Tip: Write a meaningful description. The AI uses this information to decide which system is relevant for a question. For example: “Contains revenue, customer and article data since 2019.”

Set up an integration or skill

After creating a service, you need an integration or a skill so that the AI can use the system.

Example: Internal PostgreSQL database

1. Create a service (Remote host: 192.168.10.5, Remote port: 5432, Protocol: PostgreSQL)
2. Go to Settings → Integrations and set up a PostgreSQL integration
3. Under “How is the target reachable?” choose Through the on-premises connector and pick your service below it. Address and port come from there; you still enter username, password and database yourself

Example: Your own MCP server in the company network

1. Create a service (Remote host: 192.168.10.40, Remote port: 8080, Protocol: HTTP)
2. Go to Settings → Integrations and create your own MCP server
3. Under “How is the target reachable?” choose Through the on-premises connector and pick your service below it
4. As the server URL, enter your MCP server’s internal address exactly as it reads in your network (e.g. http://mcp.intern.company.com:8080/mcp). Host and port are replaced by the service, the path is kept

The MCP server does not have to be reachable from the internet for this.

Example: Internal ERP system (API)

1. Create a service (Remote host: 192.168.10.20, Remote port: 8080, Protocol: HTTP)
2. Create a skill (e.g. with the skill builder assistant) that calls the API of the ERP system
3. Use the assigned address as the API endpoint in the skill

Example: File server / NAS

1. Create a service (Remote host: 192.168.10.30, Remote port: 445, Protocol: SMB)
2. Go to Settings, Data sources and connect the share as a data source. You simply pick the server from the list of connector services there
3. Initial indexing starts automatically, after which the files are searchable in the chat

Note: For files you do not need a custom skill. The data source handles indexing, syncing and source references, and optionally the Windows file permissions as well, so each person only finds their own files.

Test the connection

1. In the tunnel detail view, click “Test connection”
2. For each service it shows:
   • Reachable: Connection successful, latency in milliseconds
   • Not reachable: Connection failed, with the reason in plain words and the system’s own message below it; use “Copy details” to paste both, including the error ID, into a support request

If a service is not reachable, check:

• Is the WireGuard tunnel active on your firewall?
• Is the target system switched on and reachable?
• Are the Allowed IPs correctly configured on the firewall?
• Does the firewall allow traffic from the WireGuard interface to the target system?

Security

• Encryption: All data is transmitted encrypted through the WireGuard tunnel using state-of-the-art cryptography
• Outbound only: The connection can only be initiated by 9brains, your network is not reachable from the outside
• Tenant isolation: Every workspace has its own tunnels and key pairs. Other workspaces cannot access your systems
• Minimal permissions: 9brains only accesses the explicitly configured services, no access to other systems in your network

Common problems

Tunnel shows “Error” instead of “Connected”

9brains names the reason on the tunnel and in the overview, for example when the firewall does not answer the WireGuard handshake. Usually it is one of these:

• Firewall peer not configured: Enter the displayed public key as a peer in your firewall
• UDP port not reachable: Make sure that the WireGuard port (e.g. 51820) is reachable from the outside
• Wrong public key: Compare the peer public key in 9brains with the actual public key of your firewall

Service not reachable despite active tunnel

• Firewall rules: Check whether traffic from the WireGuard interface to the internal system is allowed
• Allowed IPs: The tunnel IP from 9brains must be in the Allowed IPs of the peer on your firewall
• Access list in front of it: If a server in front of the service (e.g. an nginx) or the target system itself only admits certain source addresses, our address has to be allowed there. You find it on the tunnel under Source address for firewall rules
• Target system: The system must be switched on and listening on the specified port. If a service does not answer twice in a row, 9brains refuses connections to it until it answers again; the service then says so

Feature not visible

• The On-Premises Connector is only available with a Business license or higher
• Only administrators can configure tunnels and services