You're migrating your on-premises data warehouse to BigQuery. One of your data sources is a MySQL database hosted on-premises without a public IP address. You want to ingest data into BigQuery securely, avoiding the use of the public internet. What is the best way to achieve this?