オープンソース ツールと最小限の追加リソースを使用して VPC の外部から Cloud SQL インスタンスへの接続を確立するには、その VPC 内で構成された中間 VM でプロキシ サービスを実行します。新しい VM を構成するか、Cloud SQL インスタンスの VPC 内ですでに実行されている VM を使用できます。
セルフマネージド ソリューションである中間 VM を使用すると、通常は Network Connectivity プロダクトを使用する場合よりも費用が少なくて済み、セットアップ時間も短くなります。ただし欠点もあります。接続の可用性、セキュリティ、データ スループットはすべて中間 VM に依存することになるほか、中間 VM はプロジェクトの一部としてご自身で維持管理する必要があります。
IAP を介して接続する
Identity-Aware Proxy（IAP）を使用すると、中間 VM の内部 IP アドレスを公開せずに Cloud SQL インスタンスに安全に接続できます。このルートからのアクセスは、ファイアウォール ルールと Identity and Access Management（IAM）を組み合わせて使用することによって制限します。そのため、IAP は開発やプロトタイピングのような非本番環境の用途に適したソリューションです。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[],[],null,["# Connect to a Cloud SQL instance from outside its VPC\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/connect-to-instance-from-outside-vpc \"View this page for the MySQL database engine\") \\| PostgreSQL \\| [SQL Server](/sql/docs/sqlserver/connect-to-instance-from-outside-vpc \"View this page for the SQL Server database engine\")\n\n\u003cbr /\u003e\n\nThis page describes how to connect to a Cloud SQL\ninstance from outside its configured Virtual Private Cloud (VPC).\n\nBefore you begin\n----------------\n\nBefore you begin, make sure that you complete the following actions:\n\n1. You [create a Cloud SQL instance](/sql/docs/postgres/create-instance).\n2. You [configure your instance to use an internal IP address](/sql/docs/postgres/configure-private-ip) instead of an external IP address.\n\n\u003cbr /\u003e\n\nAbout external connections\n--------------------------\n\nYour Cloud SQL instance consists of a number of nodes within a\nGoogle-managed VPC. When you create an instance, you also configure [private services access](/sql/docs/postgres/configure-private-services-access) or [Private Service Connect](/sql/docs/postgres/configure-private-service-connect)\nbetween one of your VPCs and the Google-managed VPC containing your new\ninstance. This peered connection lets you use internal IP addresses\nto access resources on the instance's VPC as if they're part of your own VPC.\n\nIn the following situations, connect to your instance from outside a\nconnected VPC:\n\n- Your application runs outside of the VPC that you used to connect to your instance through private services access or Private Service Connect.\n\n- Your application runs on a VPC that exists outside of Google's network.\n\n- Your application runs on a machine that's located somewhere\n else on the public internet.\n\nIn all of these cases, you must configure an additional service to enable\nthis kind of external connection to your Cloud SQL instance.\n\nWe recommend the following solutions for making external connections,\ndepending upon your needs:\n\n- For project development or prototyping, or for a relatively low-cost\n production environment, [configure an intermediary virtual machine\n (VM)](#vm)---also known as a *bastion*---within your VPC. Various\n methods exist to build on this intermediary VM to transform it into a secure connection\n between an external application environment and your\n Cloud SQL instance.\n\n- For production environments that require high availability, consider\n [establishing a permanent connection between the VPC and your\n application](#vpn) through either Cloud VPN or Cloud Interconnect.\n\nThe following sections describe these solutions.\n\nConnect through an intermediary VM\n----------------------------------\n\nTo establish a connection to a Cloud SQL instance from\noutside its VPC using open source tools and a minimum of additional\nresources, run a proxy service on an intermediary VM that's configured within that\nVPC. You can configure a new VM or use a VM already running within your\nCloud SQL instance's VPC.\n\nAs a self-managed solution, using an intermediary VM generally costs\nless and has a faster set-up time than [using a Network Connectivity\nproduct](#vpn). It also has downsides: the connection's availability,\nsecurity, and data throughput all become dependent on the intermediary\nVM, which you must maintain as part of your project.\n\n### Connect through IAP\n\nUsing [Identity-Aware Proxy (IAP)](/iap/docs/concepts-overview), you can\nconnect to your Cloud SQL instance securely without the need to expose the intermediary VM's internal IP address. You use a combination of firewall\nrules and Identity and Access Management (IAM) to limit access through this route.\nThis makes IAP a good solution for non-production uses\nlike development and prototyping.\n\nIn this diagram, IAP serves as the gateway between the external client that's outside the VPC and the intermediary VM that's in\nthe VPC. The client creates an SSH tunnel to the IAP. The Cloud SQL Auth Proxy encrypts the traffic between the VM and the Cloud SQL instance. Through these two proxies, communication is established between the client and the instance.\n\nTo configure IAP access to your instance, follow these steps:\n\n1. On your external client, [install](/sdk/docs/install)[gcloud CLI](/sdk/gcloud).\n\n2. On the intermediary VM, [download and install the Cloud SQL Auth Proxy](/sql/docs/postgres/sql-proxy#install).\n\n3. On the intermediary VM, [start the Cloud SQL Auth Proxy](/sql/docs/postgres/connect-auth-proxy#start-proxy).\n\n Because your VM is configured with an internal IP address, when you start the Cloud SQL Auth Proxy, you must provide the `--private-ip` option.\n4. In your Google Cloud project, [enable IAP TCP forwarding](/iap/docs/using-tcp-forwarding#preparing_your_project_for_tcp_forwarding).\n\n When defining the new firewall rule, allow ingress TCP traffic to\n port `22` (SSH). If you are using [your project's default\n network](/vpc/docs/vpc#default-network) with its [pre-populated\n `default-allow-ssh`\n rule](/vpc/docs/firewalls#more_rules_default_vpc) enabled, then you\n don't need to define an additional rule.\n5. Configure port forwarding between your external client and the\n intermediary VM using\n [SSH through IAP](/iap/docs/using-tcp-forwarding#tunneling_ssh_connections):\n\n ```bash\n gcloud compute ssh VM_NAME \\\n --tunnel-through-iap \\\n --zone=ZONE_NAME \\\n --ssh-flag=\"-L 5432:localhost:5432\"\n ```\n\n Make the following replacements:\n - \u003cvar translate=\"no\"\u003eVM_NAME:\u003c/var\u003e the name of the VM\n - \u003cvar translate=\"no\"\u003eZONE_NAME:\u003c/var\u003e the name of the zone that's associated with the VM\n6. On your external client, test your connection using [`psql`](/sql/docs/postgres/connect-admin-ip).\n\n### Connect through a SOCKS proxy\n\nRunning a SOCKS service on the intermediary VM provides a flexible and\nscalable connection to your Cloud SQL instance, with end-to-end encryption provided by the Cloud SQL Auth Proxy.\n\nFor more information on using a SOCKS proxy to connect to your Cloud SQL instance, see [Connect using an intermediate proxy (SOCKS5)](/sql/docs/postgres/connect-multiple-vpcs#intermediate-proxy).\n\n### Connect through a pooler\n\nIf you need to install and run the Cloud SQL Auth Proxy on the intermediary VM,\ninstead of an external client, then you can enable secure\nconnections to it by pairing it with a *protocol-aware proxy* , also\nknown as a *pooler* . Popular open source poolers for PostgreSQL include\n[Pgpool-II](https://pgpool.net/) and\n[PgBouncer](https://www.pgbouncer.org/).\n\nIn this solution, you run both the Cloud SQL Auth Proxy and the pooler on the\nintermediary VM. Your client or application can then securely\nconnect directly to the pooler over SSL, without the need to run any\nadditional services. The pooler takes care of passing PostgreSQL\nqueries along to your Cloud SQL instance through the\nCloud SQL Auth Proxy.\n\nBecause every Cloud SQL instance has a\nseparate internal IP address, each proxy service can communicate with\nonly one specific instance: either the primary instance, the stand-by,\nor a read pool. Therefore, for every instance, you must run a separate pooler service with an appropriately configured SSL certificate.\n\nConnect through Cloud VPN or Cloud Interconnect\n-----------------------------------------------\n\nFor production work requiring high availability (HA), we recommend the\nuse of a Google Cloud\n[Network Connectivity](/network-connectivity%0A/docs/how-to/choose-product) product, such as\n[Cloud VPN](/network-connectivity/docs/vpn) or\n[Cloud Interconnect](/network-connectivity/docs/interconnect),\ndepending upon your external service's needs and network topology. You\nthen configure\n[Cloud Router](/network-connectivity/docs/router/concepts/overview)\nto advertise the appropriate routes.\n\nTo learn more about Network Connectivity solutions, see [Choosing a Network Connectivity product](/network-connectivity/docs/how-to/choose-product).\n\nWhat's next\n-----------\n\n- Learn more about [private IP](/sql/docs/postgres/private-ip).\n- Learn more about [Private services access and on-premises\n connectivity](/vpc/docs/private-services-access#on-premises-connectivity) in Google-managed VPCs.\n- Learn more about using [Private Service Connect](/sql/docs/postgres/configure-private-service-connect) to connect to a Cloud SQL instance."]]
