How to connect Cloud SQL PostgreSQL using a private IP from local machine via OpenVPN

[Nikita_G]

I have set up a Point-to-Site VPN in Google Cloud using OpenVPN. How can I establish a connection to Cloud SQL PostgreSQL using a private IP from my local machine, also please provide some extra info regarding Point-to-Site VPN setup.

Any insights are greatly appreciated.

[ms4446 · Accepted solution]

Connecting to your Cloud SQL PostgreSQL instance using a private IP via OpenVPN is a great way to ensure secure access to your database. Here’s a step-by-step guide to help you set up and establish this connection.

Think of Point-to-Site VPNs as a secure tunnel between your local machine (or a few devices) and your private network in Google Cloud. This allows your local machine to essentially act like it's within your cloud network, which is key for accessing private IP addresses securely.

Setting Up the Connection

Cloud SQL Configuration:

1. Enable Private IP: Ensure your Cloud SQL PostgreSQL instance has "Private IP" enabled and is associated with the same Virtual Private Cloud (VPC) network as your OpenVPN server.

2. Note the Private IP: Take note of the private IP address assigned to your Cloud SQL instance. This is what you'll use to connect.

Verify Network Routes:

1. OpenVPN Server: Confirm your OpenVPN server has the necessary routes to reach your Cloud SQL instance's private IP address within the VPC.

2. Cloud Router: If your resources are in different subnets, you might need custom routes via Cloud Router to ensure they can communicate.

Connect and Access:

1. Establish VPN Connection: Use your OpenVPN client on your local machine to connect to your Point-to-Site VPN.

2. Connect to Cloud SQL: Use your database client (like psql or pgAdmin). Use the private IP address of your Cloud SQL instance as the host, the standard PostgreSQL port (5432), and your Cloud SQL credentials.

   psql -h <private_ip_address> -U <username> -d <database_name>

Important Considerations:

• Firewall Rules: Double-check your VPC firewall rules. Allow traffic from your OpenVPN server's IP range to your Cloud SQL instance's private IP on port 5432.

• Authorized Networks: In your Cloud SQL settings, add the IP range of your local network to the "Authorized Networks" section.

Troubleshooting Tips:

• Verify your network routes and firewall rules if you can't connect.

• Make sure your OpenVPN connection is active and you can ping your Cloud SQL instance's private IP.