Connecting on-premise systems

Many industrial systems run inside a company's own network, behind a firewall. Makini reaches them through a VPN tunnel into that network, so an on-premise ERP or CMMS works through the same API as any cloud system.

When you need it

Use a VPN connection when the system you connect:

is installed on your own servers, or your customer's, and isn't reachable from the internet, or

sits behind a firewall that only lets in traffic from known networks.

You set it up once, in Makini Link, while you connect. Makini then syncs, reads and writes over the tunnel. If a system is reachable directly, you need nothing here.

Supported VPN types

OpenVPN profiles

OpenVPN, AWS Client VPN and Azure VPN Gateway. Upload the .ovpn profile. Add a username and password only if your server asks for one.

AWS Client VPN: use certificate authentication on the endpoint.

Azure VPN Gateway: use the OpenVPN profile from the point-to-site download.

SSL VPN gateways

Cisco Secure Client (AnyConnect), Palo Alto GlobalProtect and Fortinet FortiClient. Enter the gateway address, username and password. Optionally add a group or realm, and the gateway's certificate fingerprint.

The tunnel runs unattended, so use a service account that doesn't prompt for a second factor at every sign-in.

WireGuard

Upload a WireGuard .conf file with this peer's [Interface] and your network's [Peer].

Mesh networks

Tailscale and NetBird. Enter a reusable, pre-authorized auth key (Tailscale) or a reusable setup key (NetBird).

Tailscale: optionally name the machine and route traffic through an exit node, entered by its tailnet IP. Self-hosted control servers are supported.

NetBird: optionally point to a self-hosted management server.

Available on request

Citrix Secure Access, SonicWall NetExtender, Cloudflare WARP and NordLayer. Pick yours in Makini Link and click Ask Makini to set this up. We work out the route into your network with you, and often there is a second way in that we can turn on the same day.

Connect through Makini Link

VPN connections are available for most platforms. Your platform's connection guide says which method applies.

Start the connection

Open Makini Link from your application, or from a magic link, and choose the platform. Continue to the credentials step.

Turn on the VPN

Switch on Connect to on-prem system via VPN/Firewall, then choose your VPN type.

Add the VPN details

Click Upload file to add a configuration file, or fill in the fields your VPN type needs. Fields under Sign-in, only if your gateway asks for one go together: fill in both or neither.

Enter the system's credentials and connect

Fill in the credentials for the system itself and click Connect. Makini brings the tunnel up first, then verifies your credentials through it. The wait screen shows both steps.

Check the result

When both succeed, Link carries on to finish the connection. If the system refuses the credentials, the tunnel stays up: Link shows Connected and the address your system sees Makini's traffic coming from, so you only correct the credentials and click Connect again. If the tunnel itself fails, Link shows the VPN's own error message, so your IT team can act on it.

Security by design

Configuration stays in the browser until you connect. Link reads your .ovpn or .conf file in the browser and sends it in the request. Makini stores it in an encrypted secret store and never shows it again, not even in the dashboard. To change it, you replace it.

No silent fallback. If the tunnel is down, Makini waits for it. It never sends the request over the open internet instead.

One network per flow. A person connecting through Link sees only the network they set up there. Networks that other people set up in your workspace are never shown to them.

Manage networks in the dashboard

Go to Connections → Network to see every network path your workspace uses. Each row shows:

Column	Meaning
Name	The network's name.
Type and Provider	VPN and its VPN type, or a network Makini manages for you, marked Makini.
Status	Connected, Connecting, We couldn't connect (with the VPN's own error below it) or Switched off.
Source IP	The address your system sees Makini's traffic coming from. Give it to your security team to allowlist.
Used by	The connections that go over this network.

From here you can:

Add a network yourself, with the same VPN types as in Link.

Replace configuration when a profile or key changes.

Remove a network. Makini refuses while connections still use it, so none of them is moved to the open internet by accident.

One network can serve many connections. To route a connection over one, open the connection's row menu on the Platform tab, choose Network, and pick the network or Direct.

The Network tab needs the permission to view settings, and adding or changing a network needs the permission to change them.

If a cloud system only accepts traffic from known addresses, contact us. We can route your connection over a network Makini manages. It then appears on the Network tab with a Makini badge and its Source IP.

Connecting on-premise systems

When you need it#

Supported VPN types#

Connect through Makini Link#

Security by design#

Manage networks in the dashboard#

When you need it

Supported VPN types

Connect through Makini Link

Security by design

Manage networks in the dashboard