Yeh, we have a site to site VPN through Cisco hardware firewalls. This is a good way to do it because it removes extra complexity from the database. Let the database handle just what it needs to do, and do it well, because there's probably better tools for the other stuff elsewhere.
An encrypted tunnel that isn't initiated at the database level should work fine.
Addendum: I'm more than a little puzzled that someone would be aware that a particular nosql database didn't support encryption natively and yet wasn't aware how tunneling works.
You are making an assumption in your addendum that uggedal does not understand how tunneling works. All he did was ask how they handle security not "how does tunneling work?"
I've actually used http://www.tinc-vpn.org/ to tunnel Tokyo Tyrant between data centers. It was a bit flaky at times though, so hardware Cisco tunneling looks like a good option if you have access to the firewall in your environment (eliminates all cloud providers).
