Configuring Public IP Connectivity

MySQL   |  PostgreSQL

This page describes how to configure public IP connectivity for a Cloud SQL instance.

Introduction

You can configure your Cloud SQL instance to have a public IPv4 address, and to accept connections from specific IP addresses or a range of addresses by adding authorized addresses to your instance.

For help with connecting an administration client to your instance over an IP connection, see Connecting mysql Client using IP addresses.

If you configure your instance to accept connections via its public IP address, you should also configure it to use SSL to keep your data secure. For more information, see Configure SSL for Instances.

To configure your instance with an IP address that is not exposed to the public internet, see Configuring Private IP Connectivity.

Enabling public IP and adding an authorized address or address range

To enable public IP and add an authorized address:

When you enable public IP for your instance, it is configured with a public, static IPv4 address.

Console

Note: You cannot configure public IP or authorized addresses on a failover replica using Google Cloud Platform Console. You must use the gcloud command line tool or the API.

1. Go to the Cloud SQL Instances page in the Google Cloud Platform Console.

   Go to the Cloud SQL Instances page

2. Click the instance name to open its Instance details page.
3. Select the Connections tab.
4. Select the Public IP checkbox.
5. Click Add network.
6. In the Network field, enter the IP address or address range you want to allow connections from.

   Use CIDR notation.

7. Optionally, enter a name for this entry.
8. Click Done.
9. Click Save to update the instance.

gcloud

1. If you haven't already, add an IPv4 address to the instance:

   gcloud sql instances patch [INSTANCE_NAME] --assign-ip
   

2. Show all existing authorized addresses by describing the instance:

   gcloud sql instances describe [INSTANCE_NAME]
   

   Look for authorizedNetwork entries under ipConfiguration, and note any authorized addresses you want to keep.

3. Update the authorized network list, including all addresses you want included.

   gcloud sql instances patch [INSTANCE_NAME] --authorized-networks=[IP_ADDR1],[IP_ADDR2]...
   

   Use CIDR notation.

4. Confirm your changes:

   gcloud sql instances describe [INSTANCE_NAME]
   

When you remove an authorized address, existing connections from that address are not disconnected. If you want to disconnect existing connections, restart your instance.

cURL

1. Show all existing authorized addresses by describing the instance:

   ACCESS_TOKEN="$(gcloud auth application-default print-access-token)"
   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          -X GET \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>?fields=settings
   

2. Update the instance, including all addresses you want set on the instance:

   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          --header 'Content-Type: application/json' \
          --data '{"settings" : {"ipConfiguration" :
                                 {"authorizedNetworks" :
                                 [{ "value": "<IP_ADDR1>" }, { "value": "<IP_ADDR2>" } ]}}}' \
          -X PATCH \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>
   

   Use CIDR notation.

3. Confirm your changes:

   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          -X GET \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>?fields=settings
   

When you remove an authorized address, existing connections from that address are not disconnected. If you want to disconnect existing connections, restart your instance.

Removing an authorized address or address range

To remove an authorized address:

Console

Note: You cannot configure public IP or authorized addresses on a failover replica using Google Cloud Platform Console. You must use the gcloud command line tool or the API.

1. Go to the Cloud SQL Instances page in the Google Cloud Platform Console.

   Go to the Cloud SQL Instances page

2. Click the instance name to open its Instance details page.
3. Select the Connections tab.
4. Click the delete icon for the address you want to delete.
5. Click Save to update the instance.

gcloud

1. Show all existing authorized addresses by describing the instance:

   gcloud sql instances describe [INSTANCE_NAME]
   

   Look for authorizedNetwork entries under ipConfiguration, and note any authorized addresses you want to keep.

2. Update the authorized network list, dropping off any addresses you want to remove.

   gcloud sql instances patch [INSTANCE_NAME] --authorized-networks=[IP_ADDR1],[IP_ADDR2]...
   

3. Confirm your changes:

   gcloud sql instances describe [INSTANCE_NAME]
   

cURL

1. Show all existing authorized addresses by describing the instance:

   ACCESS_TOKEN="$(gcloud auth application-default print-access-token)"
   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          -X GET \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>?fields=settings
   

2. Update the instance, dropping off any addresses you want remove:

   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          --header 'Content-Type: application/json' \
          --data '{"settings" : {"ipConfiguration" :
                                 {"authorizedNetworks" :
                                 [{ "value": "<IP_ADDR1>" }, { "value": "<IP_ADDR2>" } ]}}}' \
          -X PATCH \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>
   

3. Confirm your changes:

   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          -X GET \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>?fields=settings
   

When you remove an authorized address, existing connections from that address are not disconnected. If you want to disconnect existing connections, restart your instance.

Configuring an instance to refuse all public IP connections

To configure an instance to refuse all public IP connections:

Console

Note: You cannot configure public IP or authorized addresses on a failover replica using Google Cloud Platform Console. You must use the gcloud command line tool or the API.

1. Go to the Cloud SQL Instances page in the Google Cloud Platform Console.

   Go to the Cloud SQL Instances page

2. Click the instance name to open its Instance details page.
3. Select the Connections tab.
4. Click the delete icon for all authorized addresses.
5. Click Save to update the instance.

gcloud

1. Clear the authorized address list:

   gcloud sql instances patch [INSTANCE_NAME] --clear-authorized-networks
   

2. Confirm your changes:

   gcloud sql instances describe [INSTANCE_NAME]
   

cURL

1. Show all existing authorized addresses by describing the instance:

   ACCESS_TOKEN="$(gcloud auth application-default print-access-token)"
   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          -X GET \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>?fields=settings
   

2. Update the instance with an empty address list:

   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          --header 'Content-Type: application/json' \
          --data '{"settings" : {"ipConfiguration" :
                                 {"authorizedNetworks" : [] }}}' \
          -X PATCH \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>
   

3. Confirm your changes:

   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          --header 'Content-Type: application/json' \
          -X GET \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>?fields=settings
   

When you remove an authorized address, existing connections from that address are not disconnected. If you want to disconnect existing connections, restart your instance.

Disabling public IP

Note: When you disable public IP for an instance, you release its IPv4 address. If you later reenable public IP for this instance, it will get a different IPv4 address, and all applications that use the public IP address to connect to this instance must be modified.

To disable public IP:

Console

Note: You cannot configure public IP or authorized addresses on a failover replica using Google Cloud Platform Console. You must use the gcloud command line tool or the API.

1. Go to the Cloud SQL Instances page in the Google Cloud Platform Console.

   Go to the Cloud SQL Instances page

2. Click the instance name to open its Instance details page.
3. Select the Connections tab.
4. Deselect the Public IP checkbox.
5. Click Save to update the instance.

gcloud

1. Update the instance:

   gcloud sql instances patch [INSTANCE_NAME] --no-assign-ip
   

2. Confirm your changes:

   gcloud sql instances describe [INSTANCE_NAME]
   

cURL

1. Show all existing authorized addresses by describing the instance:

   ACCESS_TOKEN="$(gcloud auth application-default print-access-token)"
   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          -X GET \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>?fields=settings
   

2. Update the instance:

   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          --header 'Content-Type: application/json' \
          --data '{"settings" : {"ipConfiguration" :
                                  “ipv4Enabled”: false }}}'  \
          -X PATCH \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>
   

3. Confirm your changes:

   curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
          -X GET \
          https://www.googleapis.com/sql/v1beta4/projects/<PROJECT-ID>/instances/<INSTANCE_NAME>?fields=settings
   

What's next

• Create and manage SSL keys for your instance.
• Connect an administration client to your instance.
• Connect to your instance from an external application.