Purpose

This document provides comprehensive setup instructions for securely connecting to DvSum SaaS services using Site-to-Site VPN (IPSec IKEv2), enabling fully private network access to:

• REST APIs (apis.dvsum.ai)
• WebSocket Services (socket-api.dvsum.ai)
• S3 Storage Service (s3-storage.dvsum.ai)

All traffic travels through an encrypted IPSec tunnel from the customer environment to a DvSum SaaS platform through private networking.

Architecture Diagram

Key components:

• Customer environment — your network with VPN device/firewall and the DvSum gateway agent
• IPSec tunnel — encrypted site-to-site VPN over the public internet (IKEv2 / AES encryption)
• DvSum SaaS — production platform serving APIs, WebSocket, and S3 storage

Service Architecture Details

DvSum exposes three services over the private connectivity path. All three are accessed over HTTPS port 443 and are routed through the same IPSec tunnel.

Important

All three domains resolve to private IP addresses inside the DvSum network when accessed over the VPN tunnel.

These private IPs are only reachable through the tunnel — they are not accessible from the public internet.

DvSum will provide the specific private IPs for each domain after the VPN connection is established.

Information DvSum Requires from You

To configure the VPN connection on the DvSum side, please provide the following information to your DvSum’s representative before any setup begins.

1. VPN Configuration

2. Network Details

Why a static IP is required

The customer's public IP is registered in Customer Gateway on DvSum tunnel side.

Information DvSum Provides to You

Once DvSum has registered your Customer Gateway and created the VPN connection on its side, the following will be provided to you.

1. VPN Configuration File

DvSum will provide a VPN configuration file generated by AWS for your specific connection. This file contains all the parameters required to configure your VPN device. Below is the structure — actual values will be specific to your connection.

VPN Connection ID          : vpn-XXXXXXXXXXXXXXXXX

IPSec Tunnel #1

─────────────────────────────────────────────────────────────────

IKE version                : IKEv2

Authentication method      : Pre-Shared Key (PSK)

Pre-Shared Key             : <provided securely — not in this file>

Authentication algorithm   : sha1

Encryption algorithm       : aes-128-cbc

IKE lifetime               : 28800 seconds (8 hours)

Diffie-Hellman group       : Group 14 (modp2048)

ESP (IPSec Phase 2)

Authentication algorithm   : hmac-sha1-96

Encryption algorithm       : aes-128-cbc

ESP lifetime               : 3600 seconds (1 hour)

Perfect Forward Secrecy    : DH Group 14

Outside IP addresses

  Customer Gateway (your side)   : <your static public IP>

  Virtual Private Gateway        : <DvSum AWS VPN endpoint IP>

Inside IP addresses (for BGP or tunnel interface)

  Customer Gateway               : 169.254.x.x/30

  Virtual Private Gateway        : 169.254.x.x/30

MTU                        : 1436 bytes

TCP MSS adjustment         : 1379 bytes

DPD interval               : 10 seconds  |  DPD retries: 3

IPSec Tunnel #2

─────────────────────────────────────────────────────────────────

(Same structure as Tunnel 1 with different IPs and PSK)

2. IKE Version Requirement

3. Private IPs of DvSum Service Endpoints

After the VPN connection is established, DvSum will provide the private IP addresses for the three service endpoints. These must be configured in your DNS or hosts file so the gateway agent resolves the DvSum domains to private IPs.

4. DNS Resolver Configuration

DvSum will provide the following DNS resolver details. These are required if you are using Approach B (internal DNS forwarding) to resolve DvSum domains to private IPs across your entire network automatically.

Firewall and Network Requirements

The following ports and protocols must be permitted on your perimeter firewall for the VPN tunnel to establish and carry traffic.

Outbound rules (Customer machine → DvSum)

Note on data source access: The outbound rules above are specific to VPN tunnel establishment and DNS resolution toward DvSum. The machine running the DvSum gateway agent also needs outbound access to your internal data sources within your own network. If your firewall policy allows all outbound traffic by default (All traffic → 0.0.0.0/0), no additional rules are needed — the gateway agent will reach both DvSum and your internal data sources without restriction. 

If you have a restrictive outbound policy, ensure the gateway agent machine is permitted to reach your data sources on the relevant ports.

Inbound rules (DvSum → Customer Machine)

DvSum VGW public IPs

The two VGW public IPs (one per tunnel) are provided in the VPN configuration file.

DvSum always provisions two tunnels — allow both IPs on your firewall for redundancy.

In NAT-T mode (most common) all tunnel data uses UDP 4500 — ESP protocol 50 is only needed if NAT-T is disabled.

Step-by-Step Setup Instructions

The following steps guide you through the complete setup. Steps 1 and 2 are completed by DvSum. Steps 3 onwards are completed by your network team.

Key parameters to configure on your device:

Approach A — Linux /etc/hosts (single machine, simplest)

If the DvSum gateway agent runs on a single Linux machine, add the following to /etc/hosts on that machine. Replace the IPs with the actual values provided by DvSum.

# DvSum Service Endpoint Private IPs

# Replace with actual IPs provided by DvSum

<ip-provided-by-dvsum>   apis.dvsum.ai

<ip-provided-by-dvsum>   s3-storage.dvsum.ai

<ip-provided-by-dvsum>   socket-api.dvsum.ai

Example format (actual IPs will differ):

# DvSum Service Endpoint Private IPs

10.0.151.182   apis.dvsum.ai

10.0.150.69    s3-storage.dvsum.ai

10.0.157.107   socket-api.dvsum.ai

Approach B — Internal DNS forwarding (multiple machines, recommended for production)

For environments with multiple machines, configure your internal DNS server to forward queries for *.dvsum.ai to the DvSum DNS Resolver IPs provided during setup. This automatically resolves the domains to private IPs for every machine in your network.

• Configure a forwarding rule: DNS queries for *.dvsum.ai → forward to DvSum Resolver IPs
• The resolver returns the private IP of the corresponding service endpoint
• All machines in your network benefit automatically — no per-machine configuration needed

Routing Configuration

The following routes must be configured on your VPN device or network routing infrastructure.

Static routing mode

DvSum configures a corresponding static route on its side pointing back to your network CIDR (the CIDR you provided in the information-gathering step).

BGP routing mode

If using BGP, configure a BGP session with the VGW inside IP addresses from the config file. Advertise your internal network CIDR over BGP. DvSum will advertise the Landing Zone CIDR (10.0.0.0/16) back to you dynamically.

Connectivity Testing

Run the following tests from the machine running the DvSum gateway agent. All tests must pass before the setup is considered complete.

Pre-conditions before testing

The VPN tunnel must be established before running any of these tests.

DNS must be configured (/etc/hosts, internal DNS forwarding or Resolver IP)  before running HTTPS tests.

All tests must be run from the machine running the DvSum gateway agent.

1. DNS verification

Confirm DvSum domains resolve to private IPs — not public addresses.

On Linux:

getent hosts apis.dvsum.ai

# Expected: 10.0.x.x    apis.dvsum.ai   (private IP — not a public address)

getent hosts s3-storage.dvsum.ai

# Expected: 10.0.x.x    s3-storage.dvsum.ai

getent hosts socket-api.dvsum.ai

# Expected: 10.0.x.x    socket-api.dvsum.ai

On Windows (PowerShell):

Resolve-DnsName apis.dvsum.ai

# Expected: IPAddress should be 10.0.x.x (private)

Resolve-DnsName s3-storage.dvsum.ai

Resolve-DnsName socket-api.dvsum.ai

2. TCP connectivity

Confirm TCP port 443 is reachable on all three endpoint private IPs provided by DvSum.

On Linux:

nc -zv <apis-private-ip> 443

# Expected: Connection to <ip> 443 port [tcp/https] succeeded!

nc -zv <s3-private-ip> 443

# Expected: succeeded!

nc -zv <socket-private-ip> 443

# Expected: succeeded!

On Windows (PowerShell):

Test-NetConnection -ComputerName <apis-private-ip> -Port 443

# Expected: TcpTestSucceeded : True

Test-NetConnection -ComputerName <s3-private-ip> -Port 443

Test-NetConnection -ComputerName <socket-private-ip> -Port 443

3. TLS certificate validation

Confirm TLS certificates validate correctly with no errors.

openssl s_client -connect apis.dvsum.ai:443 -servername apis.dvsum.ai </dev/null 2>&1 | grep -E "subject|Verify return"

# Expected:

#   subject=CN=apis.dvsum.ai

#   Verify return code: 0 (ok)

openssl s_client -connect s3-storage.dvsum.ai:443 -servername s3-storage.dvsum.ai </dev/null 2>&1 | grep 'Verify return'

# Expected: Verify return code: 0 (ok)

openssl s_client -connect socket-api.dvsum.ai:443 -servername socket-api.dvsum.ai </dev/null 2>&1 | grep 'Verify return'

# Expected: Verify return code: 0 (ok)

4. HTTPS health checks

Confirm all three services return HTTP 200 — this validates full end-to-end connectivity.

On Linux:

curl -s https://apis.dvsum.ai/health-check

# Expected: {"status":"OK","mode":"privatelink"}

curl -s https://s3-storage.dvsum.ai/health-check

# Expected: {"status":"OK"}

curl -s https://socket-api.dvsum.ai/health-check

# Expected: {"status":"OK"}

On Windows (PowerShell):

Invoke-WebRequest -Uri https://apis.dvsum.ai/health-check | Select StatusCode, Content

# Expected: StatusCode 200

Invoke-WebRequest -Uri https://s3-storage.dvsum.ai/health-check | Select StatusCode

Invoke-WebRequest -Uri https://socket-api.dvsum.ai/health-check | Select StatusCode

5. WebSocket connectivity

Confirm the WebSocket endpoint is reachable. A 403 response confirms the connection reached the server — a valid session token is required for full authentication.

On Linux (install wscat: sudo npm install -g wscat):

wscat -c wss://socket-api.dvsum.ai/socket

# Expected: error: Unexpected server response: 403

# 403 = reached the server successfully (authentication required — this is correct)

# timeout or connection refused = network issue — check tunnel and DNS first

Alternative using curl:

curl -v --http1.1 \

  -H "Upgrade: websocket" \

  -H "Connection: Upgrade" \

  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \

  -H "Sec-WebSocket-Version: 13" \

  https://socket-api.dvsum.ai/socket

# Expected: HTTP response 400 or 403 (server received the request)

6. Full verification — run all checks at once (Linux)

echo "=== DNS ===" && \

getent hosts apis.dvsum.ai && \

getent hosts s3-storage.dvsum.ai && \

getent hosts socket-api.dvsum.ai && \

echo "=== TCP ===" && \

nc -zv <apis-private-ip> 443 && \

nc -zv <s3-private-ip> 443 && \

nc -zv <socket-private-ip> 443 && \

echo "=== HEALTH CHECKS ===" && \

curl -s https://apis.dvsum.ai/health-check && echo && \

curl -s https://s3-storage.dvsum.ai/health-check && echo && \

curl -s https://socket-api.dvsum.ai/health-check && echo && \

echo "=== ALL PASSED ==="

7. Expected results summary

Troubleshooting

DvSum, Inc. |DvSum.ai | 440 N Wolfe Road, Sunnyvale, CA 94085 | +1.844.855.3282.

CONFIDENTIAL

DvSum, Inc. |DvSum.ai | 440 N Wolfe Road, Sunnyvale, CA 94085 | +1.844.855.3282.

CONFIDENTIAL

DvSum DataPARC User Guide     < # >