Pode estabelecer a conetividade da base de dados de destino à base de dados de origem através de um túnel SSH inverso seguro. Este método requer uma VM de anfitrião de bastion no
projeto, bem como uma máquina (por exemplo, um portátil na
rede) que tenha conetividade à base de dados de origem. Google Cloud
O serviço de migração de bases de dados para o PostgreSQL recolhe as informações necessárias no momento da criação da migração e gera automaticamente o script para configurar tudo.
Consulte o diagrama seguinte:
Configure um túnel SSH inverso
Os seguintes passos são realizados no fluxo do serviço de migração de base de dados para
criar uma tarefa de migração, para configurar um túnel SSH inverso entre a base de dados de origem e a instância do Cloud SQL. Depois de fornecer alguns parâmetros, executa um conjunto de gcloud
comandos numa máquina que tenha conetividade com a base de dados de origem e com Google Cloud.
Selecione a instância de VM usada para estabelecer a conetividade entre a base de dados de origem e a instância do Cloud SQL. Normalmente, trata-se de uma VM
em execução na VPC onde a aplicação que acede à nova base de dados do Cloud SQL
é executada. A instância de VM serve como servidor bastion do túnel SSH.
Pode usar uma instância de VM do Compute Engine existente para este fim.
Escolha a instância de VM do Compute Engine na lista.
Forneça uma porta livre que o túnel SSH possa usar.
Em alternativa, pode criar uma nova VM neste passo. Selecione
CREATE A COMPUTE ENGINE VM INSTANCE e o guião gerado
inclui instruções para o criar.
Forneça um nome para a instância de VM.
Selecione um tipo de máquina para a VM.
Especifique uma sub-rede para a VM
Clique em VER SCRIPT para ver o script gerado.
Certifique-se de que a secção de ligações de replicação do ficheiro pg_hba.conf
ou as definições dos grupos de segurança do AWS RDS na base de dados de origem são atualizadas para aceitar ligações do intervalo de endereços IP da VPC do Cloud SQL.
Execute o script numa máquina que tenha acesso à base de dados de origem e à
VM do Compute Engine. O script realiza as seguintes operações:
Configura a VM do Compute Engine como um servidor bastion de túnel SSH.
Estabelece uma ligação SSH segura entre a base de dados de origem e a VPC.
Se estiver a criar uma nova VM do Compute Engine, depois de executar o script com êxito, copie o IP do servidor da VM a partir do resultado do script e introduza-o no campo de texto fornecido. A instância do Cloud SQL é atualizada
conforme necessário quando testar ou iniciar posteriormente a tarefa de migração.
Clique em CONFIGURAR E CONTINUAR.
Valide a tarefa de migração para confirmar que migrou corretamente os dados da instância da base de dados de origem para a instância da base de dados do Cloud SQL de destino.
Se a sua origem estiver numa VPN (por exemplo, na AWS ou na sua própria VPN no local), avance para a secção sobre como
ligar VPCs através de VPNs para mais informações sobre a configuração da VPN de origem e da Google Cloud VPN para funcionarem em conjunto.
Depois de configurar a tarefa de migração, a conetividade é validada e as VPNs são configuradas com êxito, se necessário. Em seguida, pode executar a tarefa.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eA secure reverse SSH tunnel can be established to connect the destination database to the source database, requiring a bastion host VM in Google Cloud and a machine with source database connectivity.\u003c/p\u003e\n"],["\u003cp\u003eThe Database Migration Service auto-generates a script for setting up the reverse SSH tunnel, guiding users through the process of selecting or creating a Compute Engine VM.\u003c/p\u003e\n"],["\u003cp\u003eUsers can choose an existing Compute Engine VM instance or create a new one, specifying details such as the VM's name, machine type, and subnet.\u003c/p\u003e\n"],["\u003cp\u003eThe generated script can be modified to use a private IP address or to create a bastion host VM on a subnet which is on a shared VPC.\u003c/p\u003e\n"],["\u003cp\u003eThe script needs to be executed on a machine with connectivity to both the source database and the Compute Engine VM, and afterwards it is important to update source database settings to accept connections from the Cloud SQL VPC's IP address range, and to configure VPN connections if needed.\u003c/p\u003e\n"]]],[],null,["# Configure connectivity using reverse SSH tunnel\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n[MySQL](/database-migration/docs/mysql/configure-connectivity-reverse-ssh-tunnel \"View this page for the MySQL version of Database Migration Service.\") \\| PostgreSQL \\| [PostgreSQL to AlloyDB](/database-migration/docs/postgresql-to-alloydb/configure-connectivity-reverse-ssh-tunnel \"View this page for the PostgreSQL to AlloyDB version of Database Migration Service.\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nOverview\n--------\n\nYou can establish connectivity from the destination database to the source database through a secure reverse SSH tunnel. This method requires a bastion host VM in the Google Cloud project as well as a machine (for example, a laptop on the network) that has connectivity to the source database. **Important:** If your source is within a VPN (in AWS, for example, or your own on-premises VPN), your source connection profile should use the VPN IP address and port instead of the source IP address and port.\n\nThe Database Migration Service for PostgreSQL collects the required information at migration creation\ntime, and auto-generates the script for setting it all up.\n\nSee the following diagram:\n\n\nSet up a reverse SSH tunnel\n---------------------------\n\nThe following steps are performed in the Database Migration Service flow for\n[creating a migration job](/database-migration/docs/postgres/create-migration-job), to set up a reverse SSH tunnel between the source database and Cloud SQL instance. After you provide some parameters, you execute a set of `gcloud`\ncommands on a machine which has connectivity to both the source database and to Google Cloud.\n\n1. Select the VM instance used to establish connectivity between the source database and the Cloud SQL instance. Typically this is a VM running in the VPC where the application accessing the new Cloud SQL database runs. The VM instance serves as the SSH tunnel bastion server.\n2. You can use an existing Compute Engine VM instance for this purpose.\n\n 1. Choose the Compute Engine VM instance from the list.\n\n 2. Provide a free port that the SSH tunnel can use.\n\n | Note: For the reverse SSH tunnel to work, set the \\`GatewayPorts\\` parameter to \\`yes\\` in the `/etc/ssh/sshd_config` file on the target server. After you update the file, restart the sshd service using the `sudo systemctl restart sshd.service` command. \n |\n | If you don't want to change the configuration of your existing VM, then create a new VM.\n3. Alternatively, you can create a new VM at this step. Select\n `CREATE A COMPUTE ENGINE VM INSTANCE` and the generated script\n includes instructions to create it.\n\n 1. Provide a name for the VM instance.\n\n 2. Select a machine type for the VM.\n\n 3. Specify a subnet for the VM\n\n | Note: A Compute Engine VM instance created by the script isn't managed by Database Migration Service. If one is created, then your organization is charged for the instance based on standard pricing, and is responsible for its management, including deleting the instance when it's no longer needed.\n4. Click **VIEW SCRIPT** to view the generated script.\n\n | By default, the script will generate a public IP address for the Compute Engine VM server. If you want the IP address to be private, then do the following:\n | - Alter the `gcloud compute instances create` command by adding the [--no-address](https://cloud.google.com/sdk/gcloud/reference/compute/instances/create#--address) flag.\n | - Alter the `gcloud compute ssh` command by adding the [--internal-ip](https://cloud.google.com/sdk/gcloud/reference/compute/ssh#--internal-ip) flag.\n |\n | Also, if you want to create a bastion host VM on a subnet which is on a shared VPC, then alter the `export SUBNET_NAME` command from the generated script to point to `/projects/`\u003cvar translate=\"no\"\u003eproject_name\u003c/var\u003e`/regions/`\u003cvar translate=\"no\"\u003eregion_name\u003c/var\u003e`/subnetworks/`\u003cvar translate=\"no\"\u003esubnetwork_name\u003c/var\u003e.\n |\n | For example:\n |\n | `export SUBNET_NAME=projects/myproject/regions/myregion/subnetworks/mysubnetwork`\n |\n | \u003cvar translate=\"no\"\u003eproject_name\u003c/var\u003e is the name of the project where the shared VPC is placed. A project has regions and subnetworks. \u003cvar translate=\"no\"\u003eregion_name\u003c/var\u003e and \u003cvar translate=\"no\"\u003esubnetwork_name\u003c/var\u003e are the names of the region and subnetwork that are associated with the VPC project.\n\n\n **Make sure the replication connections section of the `pg_hba.conf`\n file or the AWS RDS security groups definitions on the source database are updated to accept connections from the\n Cloud SQL VPC's IP address range.**\n\n \u003cbr /\u003e\n\n5. **Run the script on a machine that has access to both the source database and the\n Compute Engine VM**. The script performs the following operations:\n\n - Configures the Compute Engine VM as an SSH tunnel bastion server.\n\n - Establishes a secure SSH connection between the source database and the\n VPC.\n\n - If you're creating a new Compute Engine VM, then after successfully\n running the script, copy the VM server IP from the script output and enter\n it in the provided text field. The Cloud SQL instance will be updated\n as needed when you later test or start the migration job.\n\n6. Click **CONFIGURE \\& CONTINUE**.\n\n7. [Verify your migration job](/database-migration/docs/postgres/verify-migration) to confirm that it correctly migrated data from your source database instance to the destination Cloud SQL database instance.\n\n8. If your source is within a VPN (in AWS, for example, or your own\n on-premises VPN), proceed to the section on [connecting VPCs through VPNs](/database-migration/docs/postgres/configure-connectivity-vpns#vpc-vpn) for more information on configuring the\n source VPN and Google Cloud VPN to work with each other.\n\n9. After your migration job is configured, connectivity is verified,\n and VPNs are configured successfully if necessary, then you can run the job."]]
