This document describes how to connect to your Cloud SQL instance across
transitively peered Virtual Private Cloud (VPC) networks.

The recommended method to connect your Cloud SQL instance across
multiple VPC networks is
to [use Private Service Connect](https://docs.cloud.google.com/sql/docs/sqlserver/connect-multiple-vpcs.md.txt#connect-psc).

If your Cloud SQL instance can use only
[private services access](https://docs.cloud.google.com/vpc/docs/about-private-services-access)
for private network connectivity, then you have the
following options to connect your Cloud SQL instance to multiple
VPC networks:

- [Connect using custom advertised routes](https://docs.cloud.google.com/sql/docs/sqlserver/connect-multiple-vpcs.md.txt#custom-route)
- [Connect using an intermediate proxy (SOCKS5)](https://docs.cloud.google.com/sql/docs/sqlserver/connect-multiple-vpcs.md.txt#intermediate-proxy)
- [Connect using the Cloud SQL Auth Proxy as a service](https://docs.cloud.google.com/sql/docs/sqlserver/connect-multiple-vpcs.md.txt#proxy-service)

## Connect using Private Service Connect

[Private Service Connect](https://docs.cloud.google.com/sql/docs/sqlserver/about-private-service-connect.md.txt)
lets you connect to multiple VPC networks across different projects
or organizations. You can use Private Service Connect to connect
to either a primary instance or any of its read replicas. For more
information about Private Service Connect, see
[Private Service Connect overview](https://docs.cloud.google.com/sql/docs/sqlserver/about-private-service-connect.md.txt).

To configure a Cloud SQL instance to connect to multiple VPCs using
Private Service Connect, see
[Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/sqlserver/configure-private-service-connect.md.txt).

## Connect using custom advertised routes

You can use [Cloud Router](https://docs.cloud.google.com/network-connectivity/docs/router/concepts/overview.md.txt)
to configure custom advertised routes between two networks that go through an
intermediate VPC to connect multiple VPCs to your Cloud SQL instance.
The two VPCs must be connected using a
virtual private network (VPN), Cloud Interconnect , or any other
[Cloud Router](https://docs.cloud.google.com/network-connectivity/docs/router/concepts/overview.md.txt) supported
network.

![Custom route advertisements.](https://docs.cloud.google.com/static/sql/images/multiple-vpc-custom-route.svg)

With custom advertised routes, your Cloud SQL VPC, *VPC C* ,
is connected to your main VPC, *VPC A* , using an intermediate VPC, *VPC B*.
You can configure shared routes between these networks in the following ways:

- You can use Cloud Router to manually advertise routes between two
  networks that go through an intermediate VPC. For more information on
  how to configure Cloud Router to manually advertise routes,
  see [Transit network](https://docs.cloud.google.com/vpc/docs/vpc-peering.md.txt#transit-network).

- You can create two [HA VPN gateways](https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/topologies.md.txt#2-gcp-gateways)
  that connect to each other to bridge the two different VPCs and configure
  Cloud Router to share routes between them. For more information on how to
  set up HA VPN gateways, see
  [Create HA VPN gateways to connect VPC networks](https://docs.cloud.google.com/network-connectivity/docs/vpn/how-to/creating-ha-vpn2.md.txt#creating-ha-gw-2-gw-and-tunnel).

We recommend using custom advertised routes to connect multiple VPCs
to your Cloud SQL instance using
[Cloud Router](https://docs.cloud.google.com/network-connectivity/docs/router/concepts/overview.md.txt).

## Connect using an intermediate proxy (SOCKS5)

You can set up an intermediate proxy, such as SOCKS5 proxy,
on an intermediate VPC along with the [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/sqlserver/sql-proxy.md.txt)
in your main VPC between the client and your Cloud SQL instance. This
enables the intermediate node to forward encrypted traffic from the
Cloud SQL Auth Proxy to the Cloud SQL instance.

![Connecting using an intermediate proxy.](https://docs.cloud.google.com/static/sql/images/multiple-vpc-proxy.svg)

To use an intermediary proxy to connect to your Cloud SQL instance from multiple VPCs, follow these steps:

1. On your external client, [install](https://docs.cloud.google.com/sdk/docs/install)[gcloud CLI](https://docs.cloud.google.com/sdk/gcloud.md.txt).

2. On the intermediary VM, install, configure, and run a SOCKS server. One
   example of this server is [Dante](https://www.inet.no/dante/), a
   popular open source solution.

3. Configure the server to bind to the VM's `ens4` network interface
   for both external and internal connections. For internal connections, specify any
   port.

4. [Configure your VPC's firewall](https://docs.cloud.google.com/vpc/docs/firewalls) to allow TCP
   traffic from the appropriate IP address or range to
   the SOCKS server's configured port.

5. On your external client, [download and install the Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/sqlserver/sql-proxy.md.txt#install).

6. On your external client, [start the Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/sqlserver/connect-auth-proxy.md.txt#start-proxy).

   Because you configured your instance to use an internal IP address, when you start the Cloud SQL Auth Proxy, you must provide the `--private-ip` option.

   Also, set the `ALL_PROXY` environment variable to the intermediary VM's IP address and specify the port that the SOCKS server uses. For example, `ALL_PROXY=socks5://VM_IP_ADDRESS:SOCKS_SERVER_PORT.`

   > [!NOTE]
   > **Note:** The default port for the SOCKS server is `1080`.

   If you're connecting from a
   peered VPC, then use the intermediary VM's internal IP address;
   otherwise, use its external IP address.
7. On your external client, test your connection using a [SQL Server client](https://docs.cloud.google.com/sql/docs/sqlserver/connect-admin-ip.md.txt).

## Connect using the Cloud SQL Auth Proxy as a service

You can install and run the Cloud SQL Auth Proxy on your intermediate VPC instead
of your external client and enable secure connections by pairing it with a
protocol-aware proxy, also known as a connection pooler. Examples of connection poolers include
[PGbouncer](https://www.pgbouncer.org/), or [Pgpool-II](https://pgpool.net/)(PostgreSQL only).

This connection method allows your applications to securely connect directly to the pooler
using a configured SSL. The pooler passes databases queries to your Cloud SQL instance
using the Cloud SQL Auth Proxy.

> [!NOTE]
> **Note:** You'll need to set up your own secure connection. These connections aren't secured by Cloud SQL.