当源数据库位于 Google Cloud 外部且具有外部可访问的 IPv4 地址和 TCP 端口时，最适合使用公共 IP 连接。 Google Cloud如果源数据库托管在 Google Cloud中的其他 VPC 中，则将源数据库与 Cloud SQL 实例连接的最简单方法是使用 VPC 对等互连。
如果源数据库位于 Google Cloud外部，则将目标数据库的出站 IP 地址（和端口 5432）添加为来源网络上的入站防火墙规则。一般来说（您的特定网络设置可能不同），请执行以下操作：
打开源数据库机器的网络防火墙规则。
创建入站规则。
将规则类型设置为 PostgreSQL。
将协议设置为 TCP。
将端口范围设置为 5432。
将来源 IP 地址设置为目标数据库的出站 IP 地址。例如 12.20.36.126/32。（CIDR 表示法中的 /32 指定会将地址范围限制为仅包含一个地址，即所提供的地址。它会将子网掩码设置为 255.255.255.255）。如果您创建的 Cloud SQL 实例是高可用性实例，请添加主实例和次要实例的传出 IP 地址。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[[["\u003cp\u003ePublic IP connectivity is suitable for source databases external to Google Cloud with an accessible IPv4 address and TCP port.\u003c/p\u003e\n"],["\u003cp\u003eFor source databases in another Google Cloud VPC, VPC Peering is the recommended method to connect to the Cloud SQL instance.\u003c/p\u003e\n"],["\u003cp\u003eWhen the source database is external, an inbound firewall rule must be created on the source network, allowing the destination database's outgoing IP address and port 5432.\u003c/p\u003e\n"],["\u003cp\u003eThe outgoing IP address for a Cloud SQL instance can be found on the SQL Instances page in the Google Cloud Console.\u003c/p\u003e\n"],["\u003cp\u003eIt's highly recommended to use SSL/TLS for the source connection profile to ensure secure data transmission.\u003c/p\u003e\n"]]],[],null,["# Configure connectivity using IP allowlists\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n[MySQL](/database-migration/docs/mysql/configure-connectivity-ip-allowlists \"View this page for the MySQL version of Database Migration Service.\") \\| PostgreSQL \\| [PostgreSQL to AlloyDB](/database-migration/docs/postgresql-to-alloydb/configure-connectivity-ip-allowlists \"View this page for the PostgreSQL to AlloyDB version of Database Migration Service.\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nOverview\n--------\n\nPublic IP connectivity is most appropriate when the source database is external to Google Cloud\nand has an externally accessible IPv4 address and TCP port. If the source\ndatabase is hosted in another VPC in Google Cloud, then the easiest way to\nconnect the source database with the Cloud SQL instance is by using VPC Peering.\n\nIf your source database is external to Google Cloud, then add the destination database's **outgoing\nIP address** (and port 5432) as an inbound firewall rule on the source network. In\ngeneric terms (your specific network settings may differ), do the following:\n\n1. Open the source database machine's network firewall rules.\n\n2. Create an inbound rule.\n\n3. Set the Rule type to `PostgreSQL`.\n\n4. Set the Protocol to `TCP`.\n\n5. Set the Port range to 5432.\n\n6. Set the Source IP address to the destination database's **outgoing IP address** . For example:\n `12.20.36.126/32`. (The /32 designation in CIDR notation limits the\n address range to one address only, the one provided. It's setting the subnet\n mask to `255.255.255.255`). If the Cloud SQL instance you created\n is a high availability instance, include the outgoing IP addresses for both\n the primary and the secondary instance.\n\n\n You can use the **SQL Instances page** in the Google Cloud Console to [locate the outgoing IP addresses](/database-migration/docs/postgres/debugging-connectivity#locateoutgoingIPaddress).\n\n\n Update the `pg_hba.conf` file or AWS RDS security groups to accept connections from this IP address.\n7. Save the firewall rule and exit.\n\n| You can test connectivity by adding another, temporary inbound firewall rule using the IP address of your local machine (or `0.0.0.0/0` to allow access from anywhere), and then running the following telnet command: `telnet [SOURCE_DB_IP_ADDRESS] 5432`. The connection should succeed. Delete the temporary firewall rule.\n\nIt's also highly recommended to use SSL/TLS during the definition of the source\nconnection profile so that the data sent to and received by the source is\nsecure.\n[Learn more](/sql/docs/postgres/authorize-ssl) about SSL/TLS certificates for PostgreSQL."]]
