Configure network connectivity to self-hosted MySQL sources

This page describes how to configure network connectivity to self-hosted MySQL sources for homogeneous MySQL to Cloud SQL for MySQL migrations with Database Migration Service.

There are several methods you can use to configure the necessary network connectivity for migrations from self-hosted MySQL sources:

You can also use a reverse-SSH tunnel, but this approach requires creating additional Virtual Machines (VMs) to host the necessary network components.

Configure IP allowlist connectivity

To use the public IP allowlist connectivity method, follow these steps:

  1. Ensure that your source database has an IP address that can be reached from the public internet. You don't need to use the IP address to connect. If you have a DNS record associated with the IP, you can use that instead.
  2. Create an inbound firewall rule on your source database server to accept connections from the public IP address of your destination Cloud SQL instance. Use the following configuration:
    1. For the rule type, use port.
    2. For the allowed IP address range, add the public IP address of your destination Cloud SQL instance. You can check the public IP address of your instance on the instance details page. See View instance information in the Cloud SQL for MySQL documentation.
    3. Set the protocol to TCP.
    4. Set the port number associated with the rule to the port where your source database is listening for incoming connections. This is the same port number that you need to enter in the source connection profile.

      MySQL servers by default use the 3306 port.

    The steps for configuring firewall rules differ depending on what server software you use. For more information, refer to the documentation of your firewall product.

  3. At a later stage, when you create the source connection profile, in the Define connectivity method section, select IP allowlist.

Configure Private Service Connect interfaces

This connectivity method lets you connect to the private IP of your source database without consuming VPC peering quota. Private Service Connect interfaces are the recommended method for private IP connectivity, but they are only available when you migrate to an existing instance.

For self-hosted sources in Google Cloud

To use private connectivity with Private Service Connect interfaces for a source MySQL database hosted on a Compute Engine VM, follow these steps:

  1. Create a destination Cloud SQL instance enabled for Private Service Connect. See Create a Private Service Connect-enabled instance in the Cloud SQL documentation.
  2. Configure Private Service Connect for outbound connectivity on your instance. At a high level, this process involves:
    1. Creating a network attachment in the VPC network where you can reach the private IP address of your source database. Note that the subnet range reserved for the network attachment must be within RFC 1918 range.
    2. Assigning the network attachment to your destination Cloud SQL for MySQL instance.

    For the full process, see Configure outbound connectivity in the Cloud SQL documentation.

  3. At a later stage, when you create the source connection profile use the IP address of the Compute Engine VM where you host the MySQL database.

    You can view the IP address of the VM in the Google Cloud console.

  4. When you create the migration job select PSC interface for your connectivity method.

For self-hosted sources outside Google Cloud

To use private connectivity with Private Service Connect interfaces for a self-hosted MySQL source database that resides in a network outside Google Cloud, follow these steps:

  1. Set up direct connectivity with Cloud VPN from Google Cloud to your MySQL source.

    Depending on your network architecture, you might need to set up additional VPN gateways in your system. For more information, see Create HA VPN gateway to a peer VPN gateway in the Cloud VPN documentation.

  2. Create a destination Cloud SQL instance enabled for Private Service Connect. See Create a Private Service Connect-enabled instance in the Cloud SQL documentation.
  3. Configure Private Service Connect for outbound connectivity on your instance. At a high level, this process involves:
    1. Creating a network attachment in the VPC network where you can reach the private IP address of your source database. Note that the subnet range reserved for the network attachment must be within RFC 1918 range.
    2. Assigning the network attachment to your destination Cloud SQL for MySQL instance.

    For the full process, see Configure outbound connectivity in the Cloud SQL documentation.

  4. At a later stage, when you create the source connection profile use the private IP address of your source database instance.
  5. When you create the migration job select PSC interface for your connectivity method.

Configure private connectivity with VPC peering

This connectivity method requires that your source database IP address or hostname can be reached from your Google Cloud VPC. Self-hosted sources that reside in networks outside Google Cloud might require that you use additional network components such as Cloud VPN or Cloud Interconnect.

For self-hosted sources in Google Cloud

To use private connectivity with Virtual Private Cloud peering for a source MySQL database hosted on a Compute Engine VM, follow these steps:

  1. Ensure the Virtual Private Cloud network where your VM has an IP address assigned is configured for private services access. For more information, see Configure private services access.
  2. Make sure your destination Cloud SQL instance is configured with a private IP and Private Service Access (PSA). For more information, see Use private IP in the Cloud SQL documentation.
  3. At a later stage, when you create the source connection profile use the IP address of the Compute Engine VM where you host the MySQL database.

    You can view the IP address of the VM in the Google Cloud console.

  4. When you create the migration job select VPC Peering for your connectivity method.

For self-hosted sources outside Google Cloud

To use private connectivity with Virtual Private Cloud peering for a self-hosted MySQL source database that resides in a network outside Google Cloud, follow these steps:

  1. Set up direct connectivity with Cloud VPN to your MySQL source.

    Depending on your network architecture, you might need to set up additional VPN gateways in your system. For more information, see Create HA VPN gateway to a peer VPN gateway in the Cloud VPN documentation.

    Ensure the Virtual Private Cloud network is configured for private services access. For more information, see Configure private services access.

  2. Make sure your destination Cloud SQL instance is configured with a private IP and Private Service Access (PSA). For more information, see Use private IP in the Cloud SQL documentation.
  3. At a later stage, when you create the source connection profile use the private IP address of your source database instance.
  4. When you create the migration job select VPC Peering for your connectivity method.

What's next