Anda dapat membuat konektivitas dari database AlloyDB tujuan ke database sumber melalui tunnel SSH terbalik yang aman. Metode ini memerlukan VM host bastion dalam project Google Cloud serta mesin (misalnya, laptop di jaringan) yang memiliki konektivitas ke database sumber.
Database Migration Service untuk PostgreSQL ke AlloyDB mengumpulkan informasi yang diperlukan pada waktu pembuatan migrasi, dan membuat skrip secara otomatis untuk menyiapkan semuanya.
Lihat diagram berikut:
Menyiapkan tunnel SSH terbalik
Langkah-langkah berikut dilakukan dalam alur Database Migration Service untuk membuat tugas migrasi, guna menyiapkan tunnel SSH terbalik antara database sumber dan instance AlloyDB. Setelah memberikan beberapa parameter, Anda akan menjalankan serangkaian perintah gcloud
di komputer yang memiliki konektivitas ke database sumber dan ke Google Cloud.
Pilih instance VM yang digunakan untuk membuat konektivitas antara database sumber dan instance AlloyDB. Biasanya, ini adalah VM yang berjalan di VPC tempat aplikasi yang mengakses database AlloyDB baru berjalan. Instance VM berfungsi sebagai server bastion tunnel SSH.
Anda dapat menggunakan instance VM Compute Engine yang ada untuk tujuan ini.
Pilih instance VM Compute Engine dari daftar.
Berikan port kosong yang dapat digunakan oleh tunnel SSH.
Atau, Anda dapat membuat VM baru pada langkah ini. Pilih
CREATE A COMPUTE ENGINE VM INSTANCE dan skrip yang dihasilkan
akan menyertakan petunjuk untuk membuatnya.
Berikan nama untuk instance VM.
Pilih jenis mesin untuk VM.
Menentukan subnet untuk VM
Klik LIHAT SKRIP untuk melihat skrip yang dihasilkan.
Pastikan bagian koneksi replikasi file pg_hba.conf
atau definisi grup keamanan AWS RDS di database sumber telah diupdate untuk menerima koneksi dari
rentang alamat IP VPC AlloyDB.
Jalankan skrip di komputer yang memiliki akses ke database sumber dan VM Compute Engine. Skrip akan melakukan operasi berikut:
Mengonfigurasi VM Compute Engine sebagai server bastion tunnel SSH.
Membuat koneksi SSH yang aman antara database sumber dan VPC.
Jika Anda membuat VM Compute Engine baru, setelah berhasil menjalankan skrip, salin IP server VM dari output skrip dan masukkan di kolom teks yang disediakan. Instance AlloyDB akan diperbarui
sesuai kebutuhan saat Anda menguji atau memulai tugas migrasi nanti.
Klik KONFIGURASIKAN & LANJUTKAN.
Verifikasi tugas migrasi Anda untuk mengonfirmasi bahwa tugas tersebut telah memigrasikan data dari instance database sumber ke instance database AlloyDB tujuan dengan benar.
Jika sumber Anda berada dalam VPN (misalnya, di AWS, atau VPN lokal Anda sendiri), lanjutkan ke bagian tentang
menghubungkan VPC melalui VPN untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi VPN sumber dan VPN Google Cloud agar dapat berfungsi bersama.
Setelah tugas migrasi dikonfigurasi, konektivitas diverifikasi,
dan VPN berhasil dikonfigurasi jika diperlukan, Anda dapat menjalankan tugas.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[[["\u003cp\u003eA secure reverse SSH tunnel can be established to connect a destination AlloyDB database to a source database, requiring a bastion host VM in Google Cloud and a machine with connectivity to the source.\u003c/p\u003e\n"],["\u003cp\u003eThe Database Migration Service automatically generates a script during migration job creation to set up the reverse SSH tunnel for PostgreSQL to AlloyDB migrations.\u003c/p\u003e\n"],["\u003cp\u003eUsers can select an existing Compute Engine VM or create a new one to serve as the SSH tunnel bastion server, but any created by script is not managed by Database Migration Service.\u003c/p\u003e\n"],["\u003cp\u003eThe generated script configures the Compute Engine VM as an SSH tunnel bastion server and establishes a secure connection between the source database and the VPC.\u003c/p\u003e\n"],["\u003cp\u003eIf the source database is behind a VPN, you should use the VPN IP address and port in the source connection profile, instead of the source IP and port.\u003c/p\u003e\n"]]],[],null,["# Configure connectivity using reverse SSH tunnel\n\n\u003cbr /\u003e\n\n[MySQL](/database-migration/docs/mysql/configure-connectivity-reverse-ssh-tunnel \"View this page for the MySQL version of Database Migration Service.\") \\| [PostgreSQL](/database-migration/docs/postgres/configure-connectivity-reverse-ssh-tunnel \"View this page for the PostgreSQL version of Database Migration Service.\") \\| PostgreSQL to AlloyDB\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nOverview\n--------\n\nYou can establish connectivity from the destination AlloyDB database to the source database through a secure reverse SSH tunnel. This method requires a bastion host VM in the Google Cloud project as well as a machine (for example, a laptop on the network) that has connectivity to the source database. **Important:** If your source is within a VPN (in AWS, for example, or your own on-premises VPN), your source connection profile should use the VPN IP address and port instead of the source IP address and port.\n\nThe Database Migration Service for PostgreSQL to AlloyDB collects the required information at migration creation\ntime, and auto-generates the script for setting it all up.\n\nSee the following diagram:\n\n\nSet up a reverse SSH tunnel\n---------------------------\n\nThe following steps are performed in the Database Migration Service flow for\n[creating a migration job](/database-migration/docs/postgresql-to-alloydb/create-migration-job), to set up a reverse SSH tunnel between the source database and AlloyDB instance. After you provide some parameters, you execute a set of `gcloud`\ncommands on a machine which has connectivity to both the source database and to Google Cloud.\n\n1. Select the VM instance used to establish connectivity between the source database and the AlloyDB instance. Typically this is a VM running in the VPC where the application accessing the new AlloyDB database runs. The VM instance serves as the SSH tunnel bastion server.\n2. You can use an existing Compute Engine VM instance for this purpose.\n\n 1. Choose the Compute Engine VM instance from the list.\n\n 2. Provide a free port that the SSH tunnel can use.\n\n | Note: For the reverse SSH tunnel to work, set the \\`GatewayPorts\\` parameter to \\`yes\\` in the `/etc/ssh/sshd_config` file on the target server. After you update the file, restart the sshd service using the `sudo systemctl restart sshd.service` command. \n |\n | If you don't want to change the configuration of your existing VM, then create a new VM.\n3. Alternatively, you can create a new VM at this step. Select\n `CREATE A COMPUTE ENGINE VM INSTANCE` and the generated script\n includes instructions to create it.\n\n 1. Provide a name for the VM instance.\n\n 2. Select a machine type for the VM.\n\n 3. Specify a subnet for the VM\n\n | Note: A Compute Engine VM instance created by the script isn't managed by Database Migration Service. If one is created, then your organization is charged for the instance based on standard pricing, and is responsible for its management, including deleting the instance when it's no longer needed.\n4. Click **VIEW SCRIPT** to view the generated script.\n\n | By default, the script will generate a public IP address for the Compute Engine VM server. If you want the IP address to be private, then do the following:\n | - Alter the `gcloud compute instances create` command by adding the [--no-address](https://cloud.google.com/sdk/gcloud/reference/compute/instances/create#--address) flag.\n | - Alter the `gcloud compute ssh` command by adding the [--internal-ip](https://cloud.google.com/sdk/gcloud/reference/compute/ssh#--internal-ip) flag.\n |\n | Also, if you want to create a bastion host VM on a subnet which is on a shared VPC, then alter the `export SUBNET_NAME` command from the generated script to point to `/projects/`\u003cvar translate=\"no\"\u003eproject_name\u003c/var\u003e`/regions/`\u003cvar translate=\"no\"\u003eregion_name\u003c/var\u003e`/subnetworks/`\u003cvar translate=\"no\"\u003esubnetwork_name\u003c/var\u003e.\n |\n | For example:\n |\n | `export SUBNET_NAME=projects/myproject/regions/myregion/subnetworks/mysubnetwork`\n |\n | \u003cvar translate=\"no\"\u003eproject_name\u003c/var\u003e is the name of the project where the shared VPC is placed. A project has regions and subnetworks. \u003cvar translate=\"no\"\u003eregion_name\u003c/var\u003e and \u003cvar translate=\"no\"\u003esubnetwork_name\u003c/var\u003e are the names of the region and subnetwork that are associated with the VPC project.\n\n \u003cbr /\u003e\n\n\n **Make sure the replication connections section of the `pg_hba.conf`\n file or the AWS RDS security groups definitions on the source database are updated to accept connections from the\n AlloyDB VPC's IP address range.**\n5. **Run the script on a machine that has access to both the source database and the\n Compute Engine VM**. The script performs the following operations:\n\n - Configures the Compute Engine VM as an SSH tunnel bastion server.\n\n - Establishes a secure SSH connection between the source database and the\n VPC.\n\n -\n If you're creating a new Compute Engine VM, then after successfully\n running the script, copy the VM server IP from the script output and enter\n it in the provided text field. The AlloyDB instance will be updated\n as needed when you later test or start the migration job.\n\n6. Click **CONFIGURE \\& CONTINUE**.\n\n7. [Verify your migration job](/database-migration/docs/postgresql-to-alloydb/verify-migration) to confirm that it correctly migrated data from your source database instance to the destination AlloyDB database instance.\n\n8. If your source is within a VPN (in AWS, for example, or your own\n on-premises VPN), proceed to the section on [connecting VPCs through VPNs](/database-migration/docs/postgresql-to-alloydb/configure-connectivity-vpns#vpc-vpn) for more information on configuring the\n source VPN and Google Cloud VPN to work with each other.\n\n9. After your migration job is configured, connectivity is verified,\n and VPNs are configured successfully if necessary, then you can run the job."]]
