當來源資料庫位於 Google Cloud之外，且具備可從外部存取的 IPv4 位址和 TCP 通訊埠時，公開 IP 連線最適合用於此情況。如果來源資料庫託管於 Google Cloud中的其他 VPC，則使用虛擬私有雲對等互連，是最簡單連結來源資料庫與 Cloud SQL 執行個體的方式。
如果來源資料庫是 Google Cloud的外部資料庫，請將目的地資料庫的傳出 IP 位址 (以及連接埠 5432) 新增為來源網路上的傳入防火牆規則。一般來說 (您的具體網路設定可能有所不同)，請執行下列操作：
開啟來源資料庫機器的網路防火牆規則。
建立內送規則。
將「規則類型」設為 PostgreSQL。
將「Protocol」(通訊協定) 設為 TCP。
將 Port range 設為 5432。
將來源 IP 位址設為目的資料庫的傳出 IP 位址。例如：12.20.36.126/32。(CIDR 標記法中的 /32 指定會將位址範圍限制為單一位址，也就是提供的位址。將子網路遮罩設為 255.255.255.255)。如果您建立的 Cloud SQL 執行個體是高可用性執行個體，請將主要和次要執行個體的傳出 IP 位址都納入。
您可以使用 Google Cloud 主控台的「SQL Instances」頁面，找出傳出 IP 位址。
更新 pg_hba.conf 檔案或 AWS RDS 安全性群組，以便接受來自這個 IP 位址的連線。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003ePublic IP connectivity is suitable for source databases external to Google Cloud with an accessible IPv4 address and TCP port.\u003c/p\u003e\n"],["\u003cp\u003eFor source databases in another Google Cloud VPC, VPC Peering is the recommended method to connect to the Cloud SQL instance.\u003c/p\u003e\n"],["\u003cp\u003eWhen the source database is external, an inbound firewall rule must be created on the source network, allowing the destination database's outgoing IP address and port 5432.\u003c/p\u003e\n"],["\u003cp\u003eThe outgoing IP address for a Cloud SQL instance can be found on the SQL Instances page in the Google Cloud Console.\u003c/p\u003e\n"],["\u003cp\u003eIt's highly recommended to use SSL/TLS for the source connection profile to ensure secure data transmission.\u003c/p\u003e\n"]]],[],null,["# Configure connectivity using IP allowlists\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n[MySQL](/database-migration/docs/mysql/configure-connectivity-ip-allowlists \"View this page for the MySQL version of Database Migration Service.\") \\| PostgreSQL \\| [PostgreSQL to AlloyDB](/database-migration/docs/postgresql-to-alloydb/configure-connectivity-ip-allowlists \"View this page for the PostgreSQL to AlloyDB version of Database Migration Service.\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nOverview\n--------\n\nPublic IP connectivity is most appropriate when the source database is external to Google Cloud\nand has an externally accessible IPv4 address and TCP port. If the source\ndatabase is hosted in another VPC in Google Cloud, then the easiest way to\nconnect the source database with the Cloud SQL instance is by using VPC Peering.\n\nIf your source database is external to Google Cloud, then add the destination database's **outgoing\nIP address** (and port 5432) as an inbound firewall rule on the source network. In\ngeneric terms (your specific network settings may differ), do the following:\n\n1. Open the source database machine's network firewall rules.\n\n2. Create an inbound rule.\n\n3. Set the Rule type to `PostgreSQL`.\n\n4. Set the Protocol to `TCP`.\n\n5. Set the Port range to 5432.\n\n6. Set the Source IP address to the destination database's **outgoing IP address** . For example:\n `12.20.36.126/32`. (The /32 designation in CIDR notation limits the\n address range to one address only, the one provided. It's setting the subnet\n mask to `255.255.255.255`). If the Cloud SQL instance you created\n is a high availability instance, include the outgoing IP addresses for both\n the primary and the secondary instance.\n\n\n You can use the **SQL Instances page** in the Google Cloud Console to [locate the outgoing IP addresses](/database-migration/docs/postgres/debugging-connectivity#locateoutgoingIPaddress).\n\n\n Update the `pg_hba.conf` file or AWS RDS security groups to accept connections from this IP address.\n7. Save the firewall rule and exit.\n\n| You can test connectivity by adding another, temporary inbound firewall rule using the IP address of your local machine (or `0.0.0.0/0` to allow access from anywhere), and then running the following telnet command: `telnet [SOURCE_DB_IP_ADDRESS] 5432`. The connection should succeed. Delete the temporary firewall rule.\n\nIt's also highly recommended to use SSL/TLS during the definition of the source\nconnection profile so that the data sent to and received by the source is\nsecure.\n[Learn more](/sql/docs/postgres/authorize-ssl) about SSL/TLS certificates for PostgreSQL."]]
