이 절차의 앞부분에서 다운로드한 AWS 구성의 Pre-shared key 및 키 유형을 사용합니다.
경로 기반 라우팅 옵션을 선택하고 터널 2개를 추가합니다. 각 터널의 원격 네트워크 IP 범위 필드에는 이 절차의 앞부분에서 다운로드한 AWS 구성 파일의 IP Sec Tunnel 섹션에 있는 정적 경로 구성 옵션의 IP 주소를 사용합니다.
만들기를 클릭합니다.원격 네트워크 IP 범위
AWS RDS 콘솔에서 다음을 실행합니다.
보안 그룹을 선택합니다.
Cloud VPN의 모든 프로토콜과 포트를 허용하는 인바운드 방화벽 규칙을 추가합니다.
VPN 터널이 곧 통신을 시작합니다. AWS 측의 VPC 대시보드에서 터널 상태는 UP입니다. GCP 측에서는 Cloud VPN gateway 프로젝트의 Cloud Logging 콘솔에서 VPN 간의 트래픽을 확인합니다.
예시 2: 동적 경로가 있는 Google Cloud HA VPN을 사용하는 AWS
AWS에 HA VPN (동적 경로)을 사용하는 VPC 피어링을 설정하려면 BGP 경로를 Cloud SQL 피어링된 VPC로 내보내고 Cloud Router에서 Cloud SQL 피어링된 VPC 가져온 경로의 커스텀 공지 경로를 만들어야 합니다. 이 시점에서 Cloud Router는 Cloud SQL VPC에 AWS 경로를 공지하고 그 반대의 경로를 공지합니다. 또한 양쪽의 방화벽 규칙이 Cloud SQL 피어링 경로 CIDR과 일치해야 합니다.
AWS 측에서는 예 1의 처음 세 단계를 따르되 라우팅 옵션에서 정적 대신 동적을 선택합니다.
이 VPC 피어링을 수정하고 VPC 피어링 연결 세부정보에서 Import Custom Routes 및 Export Custom Routes를 선택한 다음 저장을 클릭합니다.
이제 피어링은 BGP 피어에서 오는 경로와 마찬가지로 VPC에서 동적 경로를 수신합니다. 이렇게 하면 VPN에서 피어링된 네트워크로의 트래픽이 허용됩니다.
하지만 Cloud Router는 아직 이 경로를 다른 네트워크에 공지하지 않습니다.
이렇게 하려면 VPC가 가져온 경로를 다른 네트워크에 공지하도록 Cloud Router에 커스텀 공지 경로를 추가해야 합니다. 자세한 내용은 커스텀 경로 가져오기 및 내보내기를 참고하세요.
Cloud Router 구성 공지 경로에서 DESTINATION_IP_RANGE 커스텀 IP 범위를 커스텀 경로로 추가합니다. 이제 BGP 피어링된 네트워크에서 가져온 Cloud SQL 네트워크 경로DESTINATION_IP_RANGE의 광고를 수신합니다. 이제 Cloud SQL 피어링된 VPC로 연결된 VPN 연결 네트워크의 트래픽이 VPN 터널을 통해 라우팅됩니다.
AWS 경로 테이블에서 경로가 전파되도록 허용합니다. 소스 데이터베이스가 포함된 서브넷의 AWS 경로 테이블에 VPN 가상 비공개 게이트웨이로 라우팅되는 DESTINATION_IP_RANGE 범위의 항목이 포함되어 있는지 확인합니다.
DESTINATION_IP_RANGETCP port 5432의 트래픽을 허용하는 보안 그룹 방화벽 인바운드 규칙을 추가합니다.
이제 연결을 설정할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[[["\u003cp\u003eTo connect a source database within a VPN (e.g., AWS or on-premises) to a destination, a VPN must also be used on the destination side.\u003c/p\u003e\n"],["\u003cp\u003eThe source database server's firewall must allow the entire internal IP range allocated for the private service connection of the VPC network used by the Cloud SQL destination instance.\u003c/p\u003e\n"],["\u003cp\u003eWhen using AWS with Google Cloud Classic VPN, you need to reserve a static IP address in Google Cloud, create a customer gateway and virtual private gateway in AWS, and configure VPN connections with static routing on both sides.\u003c/p\u003e\n"],["\u003cp\u003eWhen using AWS with Google Cloud HA VPN, you need to configure VPC peering and export BGP routes to the Cloud SQL peered VPC, creating custom advertised routes in Cloud Router and ensuring firewall rules match the Cloud SQL peering route CIDR.\u003c/p\u003e\n"],["\u003cp\u003eWhen using an HA VPN, you must ensure routes are allowed to propagate in the AWS route tables, by making sure that the range of the IP address for the destination is present, pointing to the proper Virtual Private Gateway.\u003c/p\u003e\n"]]],[],null,["# Configure connectivity using VPNs\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n[MySQL](/database-migration/docs/mysql/configure-connectivity-vpns \"View this page for the MySQL version of Database Migration Service.\") \\| PostgreSQL \\| [PostgreSQL to AlloyDB](/database-migration/docs/postgresql-to-alloydb/configure-connectivity-vpns \"View this page for the PostgreSQL to AlloyDB version of Database Migration Service.\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nOverview\n--------\n\nIf your source database is inside a VPN (in AWS, for example, or your\non-premises VPN), you also need to use a VPN on the destination side to connect\nto the source.\n\nThere are many VPN products you can use. The steps to configure VPNs vary from\none product to another, but all of them are fundamentally similar. This section\ncontains examples using AWS and Google Cloud VPNs.\n\nThe source database server's firewall must be configured to allow the entire **internal\nIP range** allocated for the **private service connection** of the\n[VPC network that the Cloud SQL destination instance is going to use](/database-migration/docs/postgres/create-migration-job#dest).\n\nTo find the **internal IP range** in the console:\n\n1. [Go to the VPC networks page](https://console.cloud.google.com/networking/networks/list) in the Google Cloud console.\n\n2. Select the VPC network that you want to use.\n\n3. Select **Private services access** \\\u003e **Allocated IP ranges for services**.\n\n4. Find the **Internal IP range** associated with the connection created by **servicenetworking-googleapis-com**.\n\n| Note: To use Virtual Private Cloud networking, you must enable the [Service Networking API](https://console.cloud.google.com/apis/library/servicenetworking.googleapis.com) for your Google Cloud project.\n\nExample 1: AWS with Google Cloud Classic VPN with static routes\n---------------------------------------------------------------\n\nFind more complete, step-by-step documentation in the following links:\n\n- On the AWS side, set up a [Site to Site VPN](https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html).\n- On the Google Cloud side, create a [Cloud VPN](/vpn/docs/how-to/creating-static-vpns) using static routing.\n\n\u003cbr /\u003e\n\nPut together, the overall sequence of steps looks like the following:\n\n1. In Google Cloud console \\\u003e VPC Networks \\\u003e External IP addresses, reserve a static IP address to use for the Cloud VPN.\n2. In the AWS VPC console:\n 1. Create a customer gateway.\n 2. Create a new virtual private gateway or add an existing one to the VPC associated with your database.\n 3. In **Routes Tables** add **route propagation**:\n 4. Click **Edit** , check the **propagate** checkbox and **Save** to add the IP address range of your Google Cloud VPC network as the destination range.\n3. In the AWS VPC console, create the VPN:\n 1. Under **VPN Connections** , select **Site-to-site VPN Connections**.\n 2. Select **Create VPN Connection**.\n 3. Enter a name for the VPN connection.\n 4. For **Virtual Private Gateway**, select the private gateway that you created or selected earlier in this procedure.\n 5. For **Customer Gateway**, select the customer gateway that you created earlier in this procedure.\n 6. For **Routing Options** , select **Static**, and specify the static IP address you reserved for the Cloud VPN as a CIDR (add /32).\n 7. Download the configuration to save the settings.\n 1. Save the file as **Default**.\n 2. Find the sections **IP Sec Tunnels** #1 and #2.\n 3. Note the IKE version and **Pre-Shared Key** for each tunnel.\n 4. Note the IP address for the **Virtual Private Gateway** for each tunnel.\n 5. Note the IP address for the **Static Route Configuration option** for each tunnel.\n4. In Google Cloud, create a [Classic VPN using static routing](/vpn/docs/how-to/creating-static-vpns).\n 1. In Google Cloud console \\\u003e Hybrid Connectivity \\\u003e VPN:\n 2. Click **Create VPN connection** .\n 1. Select your VPC network and region.\n 2. For the Cloud VPN, use the static IP address you reserved earlier in this procedure.\n 3. Use a `Pre-shared key` and key type from the AWS configuration you downloaded earlier in this procedure.\n 4. Select the **Route based** routing option and add two tunnels; for each tunnel's **Remote network IP range** field, use an IP address for the **Static Route Configuration option** from the `IP Sec Tunnel` sections of the AWS configuration file you downloaded earlier in this procedure.\n 5. Click **Create** .**Remote network IP range**\n\n\u003c!-- --\u003e\n\n5. In the AWS RDS console:\n 1. Select a security group.\n 2. Add inbound firewall rules to allow all protocols and ports from the Cloud VPN.\n\nThe VPN tunnels should begin communicating shortly. On the AWS side, in the\nVPC Dashboard, the tunnel statuses are `UP`. On the GCP\nside, view the traffic between the VPNs in the\n[Cloud Logging](https://console.cloud.google.com/logs) console in the\n`Cloud VPN gateway` project.\n\nExample 2: AWS with Google Cloud HA VPN with dynamic routes\n-----------------------------------------------------------\n\nTo get VPC Peering with an HA VPN (dynamic routes) to AWS, you need to export BGP routes to the Cloud SQL peered VPC, and create a custom advertised route in Cloud Router for the Cloud SQL peered VPC imported route. At that point, Cloud Router is advertising AWS routes to the Cloud SQL VPC and the other way around. The firewall rules on both sides also need to match the Cloud SQL peering route CIDR.\n\nOn the AWS side, you can follow the first three steps in [Example 1](#static-routes),\nexcept select **Dynamic** instead of **Static** under **Routing options**.\n\n1. Select your Cloud SQL VPC Peering configuration in the [Console](https://console.cloud.google.com/networking/peering) and note the **Destination IP ranges** under **IMPORTED ROUTES** . For more information, see [Importing and exporting custom routes](/vpc/docs/vpc-peering#importing-exporting-routes).\n2. Edit this VPC peering and check `Import Custom Routes` and `Export Custom Routes` in the VPC Peering connection details, and click **SAVE** .\n\n The peering now receives dynamic routes from your VPC like the routes\n coming from BGP peers. This allows traffic from the VPN to the peered network.\n However, Cloud Router is not yet advertising this route to other networks.\n To do so, you need to add custom advertised routes in the Cloud Router so\n that your VPC advertises the imported routes to other networks. For more\n information, see [Importing and exporting custom routes](/network-connectivity/docs/router/concepts/advertised-routes#overview-am).\n3. Add your \u003cvar translate=\"no\"\u003eDESTINATION_IP_RANGE\u003c/var\u003e custom IP range as a custom route in the Cloud Router configuration advertised routes. BGP peered networks are now receiving advertisements of the **imported Cloud SQL\n network routes** , \u003cvar translate=\"no\"\u003eDESTINATION_IP_RANGE\u003c/var\u003e. Traffic on those VPN-connected networks bound for the Cloud SQL peered VPC are now routed through the VPN tunnel.\n4. Allow routes to propagate in AWS route tables. Make sure AWS route tables for the subnets that contain your source database contain an entry for the \u003cvar translate=\"no\"\u003eDESTINATION_IP_RANGE\u003c/var\u003e range that routes to the VPN Virtual Private Gateway.\n5. Add a security group firewall inbound rule to allow traffic for \u003cvar translate=\"no\"\u003eDESTINATION_IP_RANGE\u003c/var\u003e `TCP port 5432`. Connectivity can now be established."]]
