Connect to MySQL on Google Compute Engine from App Engine and externally

Question

I successfully created a Compute Engine VM instance, and installed MySQL on it using this guide: https://cloud.google.com/solutions/setup-mysql

Now I want to connect to it from App Engine and from my home too if possible. Using this guide: https://cloud.google.com/appengine/docs/standard/python/connecting-vpc I created the connector, giving it the suggested 10.x.x.x/28 IP address.

In my app engine's app.yaml I inserted: vpc_access_connector: name: projects/xxxxxxxxxx/locations/europe-west3/conectors/xxxxxx

The VM instance shows an internal IP of 10.x.x.x and an external IP of 34.x.x.x

I am trying to connect from PHP using this line: new mysqli($servername, $username, $password, $dbname, 3306, null); but I get different errors.

When connecting to 34.x.x.x from my home: mysqli::__construct(): (HY000/2002): No connection could be made because the target machine actively refused it. (I even created a Firewall rule to allow all traffic from my home IP)

When connecting to10.x.x.x from app engine: 2002: Connection timed out

When connecting to 10.x.x.x from app engine: 2002: Connection refused

How can I make a connection?

Answer 1

My first guess is that the service inside the instance is not up and running, check if the service of MySQL is running and listening, you can try this by doing a nmap test vs. the public IP of your MySQL VM instance nmap 34.0.0.0. You should see something like this (if you are using the standard port):

PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   closed http
443/tcp  closed https
3306/tcp open  mysql

Remember that there are two firewalls you need to take care of on GCP, (VPC firewall & OS firewall). So if you are not able to see this port start the SQL service by connecting into your VM instance and typing sudo systemctl start mysql, now run again nmap 34.0.0.0 and you should see the service.

To connect from App Engine to MySQL on Compute Engine VM instance just follow this other guide .

To connect from your home It will be better for you to connect to the instance via SSH and then to access your database, or you can keep connecting by a VPN to access it with the internal IP address if you need to connect directly to the socket, just take care to avoid hitting the limitations or missing something like IAM roles and permission needed for this connection.