Google Compute Engine timeout when attempting connection over VPC to MongoDB Atlas

Question

I am doing a mongoexport and then a BigQuery load of a 50 million record collection All of my cloud functions and app engine instances connect fine to Mongo Atlas via the VPC peering connection setup via Serverless VPC Access to our Atlas hosted in GCP

However, I have not been able to get Compute Engine instances to connect via our VPC. When I add the Compute Engine instance external IP, it connects fine. When I remove that and add in the internal IP for the Compute Engine instance I get timeouts, but it does show:

2021-01-10T18:09:44.531+0000    could not connect to server: server selection error: server selection timeout, curr
ent topology: { Type: ReplicaSetNoPrimary, Servers: [{ Addr: ***.mongodb.net:27017, Type: Unkn
own, State: Connected, Average RTT: 0, Last error: connection() : dial tcp *.*.*.*:27017: i/o timeout }, { Ad
dr: ***.mongodb.net:27017, Type: Unknown, State: Connected, Average RTT: 0, Last error: connec
tion() : dial tcp *.*.*.*:27017: i/o timeout }, { Addr: ***.mongodb.net:27017, Type: Unkn
own, State: Connected, Average RTT: 0, Last error: connection() : dial tcp *.*.*.*:27017: i/o timeout }, ] }

So my best guess is I'm not putting in the right IP range, or the right specific IP to allow compute engine instances to connect internally, it seems like it's Mongo Atlas firewall blocking.

What are the proper steps to setup connection between compute engine and mongo atlas over VPC so that there is no ingress/egress and connections are direct.

Answer 1

I guess cause of this problem is firewall settings too.

Follow 2 steps below.

Step 1. Check VPC peering status

You can use VPC peering's internal access when 'status' is in active.

Check whether it is active or not.

Step 2. Check Firewall rules

If you don't have touch anything on firewall rules, Add a rule that allows each other's CIDR range at both sides.

Answer 2

I recommend you to use the Intelligence tool on GCP to discard any firewall issue, keep in mind that the tool simulate the packet not a real packet. Once you have discard the firewall rules at GCP level, ensure that the internal firewall is allowing traffic.

Answer 3

Your issue is the following: you are trying to access to this DNS to connect your MongoDB atlas cluster ***.mongodb.net. This DNS is public, and your VM need to go on the internet to resolve this DNS. And because, you haven't public IP, you can't go to the internet.

The solution is to use a Cloud NAT to allow your VM to reach the Internet.