Cloud SQL 執行個體由 Google 代管虛擬私有雲中的多個節點組成。建立執行個體時，您也會在其中一個 VPC 與包含新執行個體的 Google 管理 VPC 之間，設定私人服務存取權或 Private Service Connect。透過對等互連連線，您可以使用內部 IP 位址存取執行個體虛擬私有雲中的資源，就像這些資源是您虛擬私有雲的一部分。
在下列情況下，請從已連線的虛擬私有雲外部連線至執行個體：
您的應用程式在 VPC 外部執行，而您是透過私人服務存取權或 Private Service Connect 連線至執行個體。
您的應用程式在 Google 網路外部的 VPC 上執行。
您的應用程式在公用網路上某處的機器上執行。
在上述所有情況下，您都必須設定額外服務，才能啟用這類外部連線至 Cloud SQL 執行個體。
建議您根據需求採用下列解決方案，建立外部連線：
如要進行專案開發或原型設計，或是建立成本相對較低的生產環境，請在虛擬私有雲中設定中介虛擬機器 (VM)，也就是堡壘主機。您可以透過各種方法，以這個中介 VM 為基礎，將其轉換為外部應用程式環境與 Cloud SQL 執行個體之間的連線。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Connect to a Cloud SQL instance from outside its VPC\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/connect-to-instance-from-outside-vpc \"View this page for the MySQL database engine\") \\| [PostgreSQL](/sql/docs/postgres/connect-to-instance-from-outside-vpc \"View this page for the PostgreSQL database engine\") \\| SQL Server\n\n\u003cbr /\u003e\n\nThis page describes how to connect to a Cloud SQL\ninstance from outside its configured Virtual Private Cloud (VPC).\n\nBefore you begin\n----------------\n\nBefore you begin, make sure that you complete the following actions:\n\n1. You [create a Cloud SQL instance](/sql/docs/sqlserver/create-instance).\n2. You [configure your instance to use an internal IP address](/sql/docs/sqlserver/configure-private-ip) instead of an external IP address.\n\n\u003cbr /\u003e\n\nAbout external connections\n--------------------------\n\nYour Cloud SQL instance consists of a number of nodes within a\nGoogle-managed VPC. When you create an instance, you also configure [private services access](/sql/docs/sqlserver/configure-private-services-access) or [Private Service Connect](/sql/docs/sqlserver/configure-private-service-connect)\nbetween one of your VPCs and the Google-managed VPC containing your new\ninstance. This peered connection lets you use internal IP addresses\nto access resources on the instance's VPC as if they're part of your own VPC.\n\nIn the following situations, connect to your instance from outside a\nconnected VPC:\n\n- Your application runs outside of the VPC that you used to connect to your instance through private services access or Private Service Connect.\n\n- Your application runs on a VPC that exists outside of Google's network.\n\n- Your application runs on a machine that's located somewhere\n else on the public internet.\n\nIn all of these cases, you must configure an additional service to enable\nthis kind of external connection to your Cloud SQL instance.\n\nWe recommend the following solutions for making external connections,\ndepending upon your needs:\n\n- For project development or prototyping, or for a relatively low-cost\n production environment, [configure an intermediary virtual machine\n (VM)](#vm)---also known as a *bastion*---within your VPC. Various\n methods exist to build on this intermediary VM to transform it into a secure connection\n between an external application environment and your\n Cloud SQL instance.\n\n- For production environments that require high availability, consider\n [establishing a permanent connection between the VPC and your\n application](#vpn) through either Cloud VPN or Cloud Interconnect.\n\nThe following sections describe these solutions.\n\nConnect through an intermediary VM\n----------------------------------\n\nTo establish a connection to a Cloud SQL instance from\noutside its VPC using open source tools and a minimum of additional\nresources, run a proxy service on an intermediary VM that's configured within that\nVPC. You can configure a new VM or use a VM already running within your\nCloud SQL instance's VPC.\n\nAs a self-managed solution, using an intermediary VM generally costs\nless and has a faster set-up time than [using a Network Connectivity\nproduct](#vpn). It also has downsides: the connection's availability,\nsecurity, and data throughput all become dependent on the intermediary\nVM, which you must maintain as part of your project.\n\n### Connect through IAP\n\nUsing [Identity-Aware Proxy (IAP)](/iap/docs/concepts-overview), you can\nconnect to your Cloud SQL instance securely without the need to expose the intermediary VM's internal IP address. You use a combination of firewall\nrules and Identity and Access Management (IAM) to limit access through this route.\nThis makes IAP a good solution for non-production uses\nlike development and prototyping.\n\nIn this diagram, IAP serves as the gateway between the external client that's outside the VPC and the intermediary VM that's in\nthe VPC. The client creates an SSH tunnel to the IAP. The Cloud SQL Auth Proxy encrypts the traffic between the VM and the Cloud SQL instance. Through these two proxies, communication is established between the client and the instance.\n\nTo configure IAP access to your instance, follow these steps:\n\n1. On your external client, [install](/sdk/docs/install)[gcloud CLI](/sdk/gcloud).\n\n2. On the intermediary VM, [download and install the Cloud SQL Auth Proxy](/sql/docs/sqlserver/sql-proxy#install).\n\n3. On the intermediary VM, [start the Cloud SQL Auth Proxy](/sql/docs/sqlserver/connect-auth-proxy#start-proxy).\n\n Because your VM is configured with an internal IP address, when you start the Cloud SQL Auth Proxy, you must provide the `--private-ip` option.\n4. In your Google Cloud project, [enable IAP TCP forwarding](/iap/docs/using-tcp-forwarding#preparing_your_project_for_tcp_forwarding).\n\n When defining the new firewall rule, allow ingress TCP traffic to\n port `22` (SSH). If you are using [your project's default\n network](/vpc/docs/vpc#default-network) with its [pre-populated\n `default-allow-ssh`\n rule](/vpc/docs/firewalls#more_rules_default_vpc) enabled, then you\n don't need to define an additional rule.\n5. Configure port forwarding between your external client and the\n intermediary VM using\n [SSH through IAP](/iap/docs/using-tcp-forwarding#tunneling_ssh_connections):\n\n ```bash\n gcloud compute ssh VM_NAME \\\n --tunnel-through-iap \\\n --zone=ZONE_NAME \\\n --ssh-flag=\"-L 1433:localhost:1433\"\n ```\n\n Make the following replacements:\n - \u003cvar translate=\"no\"\u003eVM_NAME:\u003c/var\u003e the name of the VM\n - \u003cvar translate=\"no\"\u003eZONE_NAME:\u003c/var\u003e the name of the zone that's associated with the VM\n6. On your external client, test your connection using a [SQL Server client](/sql/docs/sqlserver/connect-admin-ip).\n\n### Connect through a SOCKS proxy\n\nRunning a SOCKS service on the intermediary VM provides a flexible and\nscalable connection to your Cloud SQL instance, with end-to-end encryption provided by the Cloud SQL Auth Proxy.\n\nFor more information on using a SOCKS proxy to connect to your Cloud SQL instance, see [Connect using an intermediate proxy (SOCKS5)](/sql/docs/sqlserver/connect-multiple-vpcs#intermediate-proxy).\n\n### Connect through a pooler\n\nIf you need to install and run the Cloud SQL Auth Proxy on the intermediary VM,\ninstead of an external client, then you can enable secure\nconnections to it by pairing it with a *protocol-aware proxy* , also\nknown as a *pooler* . A popular open source pooler for SQL Server is\n[ADO.NET](https://learn.microsoft.com/en-us/dotnet/framework/data/adonet/ado-net-overview/).\n\nIn this solution, you run both the Cloud SQL Auth Proxy and the pooler on the\nintermediary VM. Your client or application can then securely\nconnect directly to the pooler over SSL, without the need to run any\nadditional services. The pooler takes care of passing PostgreSQL\nqueries along to your Cloud SQL instance through the\nCloud SQL Auth Proxy.\n\nBecause every Cloud SQL instance has a\nseparate internal IP address, each proxy service can communicate with\nonly one specific instance: either the primary instance, the stand-by,\nor a read pool. Therefore, for every instance, you must run a separate pooler service with an appropriately configured SSL certificate.\n\nConnect through Cloud VPN or Cloud Interconnect\n-----------------------------------------------\n\nFor production work requiring high availability (HA), we recommend the\nuse of a Google Cloud\n[Network Connectivity](/network-connectivity%0A/docs/how-to/choose-product) product, such as\n[Cloud VPN](/network-connectivity/docs/vpn) or\n[Cloud Interconnect](/network-connectivity/docs/interconnect),\ndepending upon your external service's needs and network topology. You\nthen configure\n[Cloud Router](/network-connectivity/docs/router/concepts/overview)\nto advertise the appropriate routes.\n\nTo learn more about Network Connectivity solutions, see [Choosing a Network Connectivity product](/network-connectivity/docs/how-to/choose-product).\n\nWhat's next\n-----------\n\n- Learn more about [private IP](/sql/docs/sqlserver/private-ip).\n- Learn more about [Private services access and on-premises\n connectivity](/vpc/docs/private-services-access#on-premises-connectivity) in Google-managed VPCs.\n- Learn more about using [Private Service Connect](/sql/docs/sqlserver/configure-private-service-connect) to connect to a Cloud SQL instance."]]
