Configure network connectivity to self-hosted PostgreSQL sources

This page describes how to configure network connectivity to self-hosted PostgreSQL sources for homogeneous PostgreSQL to AlloyDB for PostgreSQL migrations with Database Migration Service.

There are several methods you can use to configure the necessary network connectivity for migrations from self-hosted PostgreSQL sources:

You can also use a reverse-SSH tunnel or a TCP proxy through a cloud-hosted VM, but these approaches require creating an intermediate Compute Engine Virtual Machine (VM) to host the necessary network components.

Configure IP allowlist connectivity

To use the public IP allowlist connectivity method, follow these steps:

  1. Ensure that your source database has an IP address that can be reached from the public internet. You don't need to use the IP address to connect. If you have a DNS record associated with the IP, you can use that instead.
  2. Ensure that outbound public IP is enabled on your destination AlloyDB for PostgreSQL primary instance. For more information, see Enable outbound public IP in the AlloyDB for PostgreSQL documentation.
  3. Create an inbound firewall rule on your source database server or network perimeter to accept connections from both outbound public IP addresses of your destination AlloyDB for PostgreSQL primary instance. Use the following configuration:
    1. For the rule type, use port.
    2. For the allowed IP address range, add both outbound public IP addresses of your destination AlloyDB for PostgreSQL primary instance. You can check the outbound IP addresses of your primary instance on the cluster details page in the Google Cloud console. See View cluster and instance details in the AlloyDB for PostgreSQL documentation.
    3. Set the protocol to TCP.
    4. Set the port number associated with the rule to the port where your source database is listening for incoming connections. This is the same port number that you need to enter in the source connection profile.

      PostgreSQL servers by default use the 5432 port.

    The steps for configuring firewall rules differ depending on what server software or firewall appliance you use. For more information, refer to the documentation of your firewall product.

  4. At a later stage, when you create the source connection profile, enter the public IP address or hostname of your source database.
  5. When you create the migration job, select IP allowlist for your connectivity method.

Configure Private Service Connect interfaces

This connectivity method lets you connect to the private IP of your source database without consuming VPC peering quota. Private Service Connect interfaces are the recommended method for private IP connectivity when migrating to an AlloyDB for PostgreSQL cluster. Private Service Connect interfaces are supported when you migrate to an existing AlloyDB for PostgreSQL cluster.

For self-hosted sources in Google Cloud

To use private connectivity with Private Service Connect interfaces for a source PostgreSQL database hosted on a Compute Engine VM, follow these steps:

  1. Create or select a destination AlloyDB for PostgreSQL cluster enabled for Private Service Connect. See Create a cluster and primary instance in the AlloyDB for PostgreSQL documentation.
  2. Configure Private Service Connect for outbound connectivity from your destination cluster. At a high level, this process involves:
    1. Creating a network attachment in the Virtual Private Cloud network where you can reach the private IP address of your source database. The subnet range reserved for the network attachment must be within RFC 1918 range.
    2. Assigning the network attachment to your destination AlloyDB for PostgreSQL cluster.

    For more information, see Configure Private Service Connect in the AlloyDB for PostgreSQL documentation.

  3. At a later stage, when you create the source connection profile, use the IP address of the Compute Engine VM where you host the PostgreSQL database.

    You can view the IP address of the VM in the Google Cloud console.

  4. When you create the migration job, select PSC interface for your connectivity method.

For self-hosted sources outside Google Cloud

To use private connectivity with Private Service Connect interfaces for a self-hosted PostgreSQL source database that resides in a network outside Google Cloud, follow these steps:

  1. Set up direct connectivity with Cloud VPN from Google Cloud to your PostgreSQL source network.

    Depending on your network architecture, you might need to set up additional VPN gateways in your system. For more information, see Create HA VPN gateway to a peer VPN gateway in the Cloud VPN documentation.

  2. Create or select a destination AlloyDB for PostgreSQL cluster enabled for Private Service Connect. See Create a cluster and primary instance in the AlloyDB for PostgreSQL documentation.
  3. Configure Private Service Connect for outbound connectivity from your destination cluster. At a high level, this process involves:
    1. Creating a network attachment in the Virtual Private Cloud network where you can reach the private IP address of your source database. The subnet range reserved for the network attachment must be within RFC 1918 range.
    2. Assigning the network attachment to your destination AlloyDB for PostgreSQL cluster.

    For more information, see Configure Private Service Connect in the AlloyDB for PostgreSQL documentation.

  4. At a later stage, when you create the source connection profile, use the private IP address of your source database instance.
  5. When you create the migration job, select PSC interface for your connectivity method.

Configure private connectivity with VPC peering

This connectivity method requires that your source database IP address or hostname can be reached from your Google Cloud VPC. Self-hosted sources that reside in networks outside Google Cloud require that you use additional network components such as Cloud VPN or Cloud Interconnect.

For self-hosted sources in Google Cloud

To use private connectivity with Virtual Private Cloud peering for a source PostgreSQL database hosted on a Compute Engine VM, follow these steps:

  1. Ensure the Virtual Private Cloud network where your VM has an IP address assigned is configured for private services access. For more information, see Configure private services access.
  2. Make sure your destination AlloyDB for PostgreSQL cluster is configured with a private IP and Private Services Access (PSA) using the same Virtual Private Cloud network. For more information, see Create a cluster and primary instance in the AlloyDB for PostgreSQL documentation.
  3. At a later stage, when you create the source connection profile, use the IP address of the Compute Engine VM where you host the PostgreSQL database.

    You can view the IP address of the VM in the Google Cloud console.

  4. When you create the migration job, select VPC Peering for your connectivity method.

For self-hosted sources outside Google Cloud

To use private connectivity with Virtual Private Cloud peering for a self-hosted PostgreSQL source database that resides in a network outside Google Cloud, follow these steps:

  1. Set up direct connectivity with Cloud VPN to your PostgreSQL source network.

    Depending on your network architecture, you might need to set up additional VPN gateways in your system. For more information, see Create HA VPN gateway to a peer VPN gateway in the Cloud VPN documentation.

    Ensure the Virtual Private Cloud network is configured for private services access. For more information, see Configure private services access.

  2. Make sure your destination AlloyDB for PostgreSQL cluster is configured with a private IP and Private Services Access (PSA). For more information, see Create a cluster and primary instance in the AlloyDB for PostgreSQL documentation.
  3. At a later stage, when you create the source connection profile, use the private IP address of your source database instance.
  4. When you create the migration job, select VPC Peering for your connectivity method.

What's next