Puedes establecer la conectividad desde la base de datos de destino de AlloyDB a la base de datos de origen a través de un túnel inverso SSH seguro. Este método requiere una VM de host bastion en el proyecto Google Cloud , así como una máquina (por ejemplo, un portátil en la red) que tenga conectividad con la base de datos de origen.
Database Migration Service para PostgreSQL a AlloyDB recoge la información necesaria en el momento de la creación de la migración y genera automáticamente la secuencia de comandos para configurarlo todo.
Consulta el siguiente diagrama:
Configurar un túnel inverso SSH
Los siguientes pasos se realizan en el flujo del servicio de migración de bases de datos para crear una tarea de migración y configurar un túnel inverso SSH entre la base de datos de origen y la instancia de AlloyDB. Después de proporcionar algunos parámetros, ejecuta un conjunto de gcloud
comandos en una máquina que tenga conectividad tanto con la base de datos de origen como con Google Cloud.
Selecciona la instancia de VM que se usa para establecer la conectividad entre la base de datos de origen y la instancia de AlloyDB. Normalmente, se trata de una VM que se ejecuta en la VPC en la que se ejecuta la aplicación que accede a la nueva base de datos de AlloyDB. La instancia de VM actúa como servidor bastión del túnel SSH.
Puedes usar una instancia de VM de Compute Engine que ya tengas.
Elige la instancia de VM de Compute Engine de la lista.
Proporciona un puerto libre que pueda usar el túnel SSH.
También puedes crear una máquina virtual en este paso. Selecciona CREATE A COMPUTE ENGINE VM INSTANCE y el guion generado
incluye instrucciones para crearlo.
Asigna un nombre a la instancia de VM.
Selecciona un tipo de máquina para la VM.
Especificar una subred para la VM
Haz clic en VER SCRIPT para ver el guion generado.
Asegúrate de que la sección de conexiones de replicación del archivo pg_hba.conf
o las definiciones de los grupos de seguridad de AWS RDS en la base de datos de origen se hayan actualizado para aceptar conexiones del intervalo de direcciones IP de la VPC de AlloyDB.
Ejecuta la secuencia de comandos en una máquina que tenga acceso tanto a la base de datos de origen como a laVM de Compute Engine. La secuencia de comandos realiza las siguientes operaciones:
Configura la máquina virtual de Compute Engine como un servidor bastion de túnel SSH.
Establece una conexión SSH segura entre la base de datos de origen y la VPC.
Si vas a crear una máquina virtual de Compute Engine, después de ejecutar la secuencia de comandos, copia la IP del servidor de la VM que genere la secuencia y pégala en el campo de texto proporcionado. La instancia de AlloyDB se actualizará según sea necesario cuando pruebes o inicies la tarea de migración más adelante.
Haz clic en CONFIGURAR Y CONTINUAR.
Verifica la tarea de migración para confirmar que ha migrado correctamente los datos de la instancia de base de datos de origen a la instancia de base de datos de destino de AlloyDB.
Si tu origen está en una VPN (por ejemplo, en AWS o en tu propia VPN local), ve a la sección sobre
conexión de VPCs a través de VPNs para obtener más información sobre cómo configurar la VPN de origen y la VPN de Google Cloud para que funcionen entre sí.
Una vez que hayas configurado la tarea de migración, se haya verificado la conectividad y se hayan configurado correctamente las VPNs (si es necesario), podrás ejecutar la tarea.
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-08-21 (UTC)."],[[["\u003cp\u003eA secure reverse SSH tunnel can be established to connect a destination AlloyDB database to a source database, requiring a bastion host VM in Google Cloud and a machine with connectivity to the source.\u003c/p\u003e\n"],["\u003cp\u003eThe Database Migration Service automatically generates a script during migration job creation to set up the reverse SSH tunnel for PostgreSQL to AlloyDB migrations.\u003c/p\u003e\n"],["\u003cp\u003eUsers can select an existing Compute Engine VM or create a new one to serve as the SSH tunnel bastion server, but any created by script is not managed by Database Migration Service.\u003c/p\u003e\n"],["\u003cp\u003eThe generated script configures the Compute Engine VM as an SSH tunnel bastion server and establishes a secure connection between the source database and the VPC.\u003c/p\u003e\n"],["\u003cp\u003eIf the source database is behind a VPN, you should use the VPN IP address and port in the source connection profile, instead of the source IP and port.\u003c/p\u003e\n"]]],[],null,["# Configure connectivity using reverse SSH tunnel\n\n\u003cbr /\u003e\n\n[MySQL](/database-migration/docs/mysql/configure-connectivity-reverse-ssh-tunnel \"View this page for the MySQL version of Database Migration Service.\") \\| [PostgreSQL](/database-migration/docs/postgres/configure-connectivity-reverse-ssh-tunnel \"View this page for the PostgreSQL version of Database Migration Service.\") \\| PostgreSQL to AlloyDB\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nOverview\n--------\n\nYou can establish connectivity from the destination AlloyDB database to the source database through a secure reverse SSH tunnel. This method requires a bastion host VM in the Google Cloud project as well as a machine (for example, a laptop on the network) that has connectivity to the source database. **Important:** If your source is within a VPN (in AWS, for example, or your own on-premises VPN), your source connection profile should use the VPN IP address and port instead of the source IP address and port.\n\nThe Database Migration Service for PostgreSQL to AlloyDB collects the required information at migration creation\ntime, and auto-generates the script for setting it all up.\n\nSee the following diagram:\n\n\nSet up a reverse SSH tunnel\n---------------------------\n\nThe following steps are performed in the Database Migration Service flow for\n[creating a migration job](/database-migration/docs/postgresql-to-alloydb/create-migration-job), to set up a reverse SSH tunnel between the source database and AlloyDB instance. After you provide some parameters, you execute a set of `gcloud`\ncommands on a machine which has connectivity to both the source database and to Google Cloud.\n\n1. Select the VM instance used to establish connectivity between the source database and the AlloyDB instance. Typically this is a VM running in the VPC where the application accessing the new AlloyDB database runs. The VM instance serves as the SSH tunnel bastion server.\n2. You can use an existing Compute Engine VM instance for this purpose.\n\n 1. Choose the Compute Engine VM instance from the list.\n\n 2. Provide a free port that the SSH tunnel can use.\n\n | Note: For the reverse SSH tunnel to work, set the \\`GatewayPorts\\` parameter to \\`yes\\` in the `/etc/ssh/sshd_config` file on the target server. After you update the file, restart the sshd service using the `sudo systemctl restart sshd.service` command. \n |\n | If you don't want to change the configuration of your existing VM, then create a new VM.\n3. Alternatively, you can create a new VM at this step. Select\n `CREATE A COMPUTE ENGINE VM INSTANCE` and the generated script\n includes instructions to create it.\n\n 1. Provide a name for the VM instance.\n\n 2. Select a machine type for the VM.\n\n 3. Specify a subnet for the VM\n\n | Note: A Compute Engine VM instance created by the script isn't managed by Database Migration Service. If one is created, then your organization is charged for the instance based on standard pricing, and is responsible for its management, including deleting the instance when it's no longer needed.\n4. Click **VIEW SCRIPT** to view the generated script.\n\n | By default, the script will generate a public IP address for the Compute Engine VM server. If you want the IP address to be private, then do the following:\n | - Alter the `gcloud compute instances create` command by adding the [--no-address](https://cloud.google.com/sdk/gcloud/reference/compute/instances/create#--address) flag.\n | - Alter the `gcloud compute ssh` command by adding the [--internal-ip](https://cloud.google.com/sdk/gcloud/reference/compute/ssh#--internal-ip) flag.\n |\n | Also, if you want to create a bastion host VM on a subnet which is on a shared VPC, then alter the `export SUBNET_NAME` command from the generated script to point to `/projects/`\u003cvar translate=\"no\"\u003eproject_name\u003c/var\u003e`/regions/`\u003cvar translate=\"no\"\u003eregion_name\u003c/var\u003e`/subnetworks/`\u003cvar translate=\"no\"\u003esubnetwork_name\u003c/var\u003e.\n |\n | For example:\n |\n | `export SUBNET_NAME=projects/myproject/regions/myregion/subnetworks/mysubnetwork`\n |\n | \u003cvar translate=\"no\"\u003eproject_name\u003c/var\u003e is the name of the project where the shared VPC is placed. A project has regions and subnetworks. \u003cvar translate=\"no\"\u003eregion_name\u003c/var\u003e and \u003cvar translate=\"no\"\u003esubnetwork_name\u003c/var\u003e are the names of the region and subnetwork that are associated with the VPC project.\n\n \u003cbr /\u003e\n\n\n **Make sure the replication connections section of the `pg_hba.conf`\n file or the AWS RDS security groups definitions on the source database are updated to accept connections from the\n AlloyDB VPC's IP address range.**\n5. **Run the script on a machine that has access to both the source database and the\n Compute Engine VM**. The script performs the following operations:\n\n - Configures the Compute Engine VM as an SSH tunnel bastion server.\n\n - Establishes a secure SSH connection between the source database and the\n VPC.\n\n -\n If you're creating a new Compute Engine VM, then after successfully\n running the script, copy the VM server IP from the script output and enter\n it in the provided text field. The AlloyDB instance will be updated\n as needed when you later test or start the migration job.\n\n6. Click **CONFIGURE \\& CONTINUE**.\n\n7. [Verify your migration job](/database-migration/docs/postgresql-to-alloydb/verify-migration) to confirm that it correctly migrated data from your source database instance to the destination AlloyDB database instance.\n\n8. If your source is within a VPN (in AWS, for example, or your own\n on-premises VPN), proceed to the section on [connecting VPCs through VPNs](/database-migration/docs/postgresql-to-alloydb/configure-connectivity-vpns#vpc-vpn) for more information on configuring the\n source VPN and Google Cloud VPN to work with each other.\n\n9. After your migration job is configured, connectivity is verified,\n and VPNs are configured successfully if necessary, then you can run the job."]]
