Connectivity
wawa runs in the cloud, in your account's region. To exchange data with a system in your clinic (an integration target), wawa needs a network path to it. We support two models.
| Private: Site-to-Site VPN | Public: customer-managed | |
|---|---|---|
| How wawa reaches the target | Over an encrypted IPsec tunnel, off the internet | Over the internet, to a public URL you publish |
| How you identify each target | A private IP (within the ranges you advertise on the tunnel) and port | A public URL that resolves to a public IP you assigned |
| Access control | Tunnel scoped to the declared prefixes, from a dedicated wawa subnet | Your firewall allowlists wawa's regional egress IPs |
| Responsibility | wawa operates its side of the tunnel; you operate yours | You. Hosting, TLS, patching and hardening of the public endpoint are the clinic's responsibility |
| Who does the work on your side | Your firewall administrator | Whoever hosts the target |
Details: Site-to-Site VPN · Public connectivity
What applies to both
- Protocols. We typically prefer HTTPS, and most integrations use it out of the box. If your system speaks another TCP- or UDP-based protocol, we can add support for it. Tell us the protocol and port of each target.
- Certificates. For HTTPS targets, a certificate from a public CA works out of the box. If you use
self-signed certificates or an internal CA, send us your internal root CA certificate so our servers trust
your internal leaf certificates: one PEM file (
-----BEGIN CERTIFICATE-----), the root itself (a CA certificate), with no private key. We can configure custom trust for any integration. If your system authenticates clients by certificate, we tell you what we need. - Credentials. Every integration needs credentials for its target. What they are depends on the integration (see each guide); sharing access ahead of time speeds up setup considerably.
- wawa initiates. wawa opens the connection to your target and polls for new data. The exception is file-based delivery (some lab results), where your system writes files to storage wawa provides. wawa does not install agents on your machines.
Which to choose
Clinical hardware and clinic-hosted software often speak protocols with weak or no built-in security, so many clinics prefer not to put them on the internet at all.
- Already have a Site-to-Site VPN with us? Use it: give us the private IPs and ports of each target from the ranges you advertised, and we reach them without anything touching the internet.
- Target already public, or no VPN-capable firewall? Use public connectivity, with our egress IPs allowlisted.
- Cloudflare Tunnel is deprecated and no longer recommended.