This topic describes the network connection configurations for OceanBase Cloud Flagship Edition instances and how to enable applications to connect to the database.
Prerequisites
- You have registered an OceanBase Cloud account and created a cluster instance and tenant. For details, see Create a cluster instance and Create a tenant.
- You have identified the application deployment location (local development machine, cloud-based ECS/VM, etc.) and the cloud provider, so that you can select an appropriate connection method.
Background information
After a tenant is created, applications cannot directly access the database. Typically, the following two types of configurations are required:
Access control: Restrict the IPs that can connect to the database.
The access control requirements vary by connection method:
Cloud providerConnection methodTenant allowlist required?Access control descriptionAll Public network connection Yes Add the client's egress IP to the allowlist. Alibaba Cloud Private network connection Yes You must add the client IP to the tenant allowlist for access control. Huawei Cloud Private network connection (PrivateLink) No Controlled by the endpoint security group. AWS Private network connection (PrivateLink) Yes You must add the client IP to the allowlist. Huawei Cloud Peering connection Yes Add the ECS/VM IP range from the peer VPC to the allowlist. Azure Private network connection (one-part connection string) Yes Configure an allowlist when using a one-part connection string. Azure Private network connection (two-part connection string) No No configuration required. Note
- For connection methods that do not support IP allowlists, such as Huawei Cloud PrivateLink, the security group is the only access control measure.
- For connection methods that support allowlists, such as AWS PrivateLink, you must also configure the security group correctly.
Network reachability: Make sure that the route between the client and the database endpoint is reachable and that intermediate firewalls and security groups allow TCP traffic on the corresponding ports.
Connection method overview
Connection method |
Application scenarios |
Whether a public endpoint is required |
Configuration complexity |
Supported cloud vendors |
|---|---|---|---|---|
| Public network connection | Local development and debugging, rapid testing, cross-cloud vendor access | Yes | Low | All |
| Private network connection | Production environments where traffic is not routed over the public network | No | Medium to high (varies by cloud vendor) | Alibaba Cloud, Huawei Cloud, AWS, Azure |
| Peering connection | Communication between VPCs within the same cloud provider | No | Medium | Huawei Cloud |
Access control description
The configuration location for access control varies by connection method:
Connection method |
Cloud vendor |
Access control method |
Description |
|---|---|---|---|
| Public network connection | All | OB Cloud tenant allowlist | Add the client outbound IP address to the allowlist. |
| Private network connection | Alibaba Cloud | OB Cloud tenant allowlist | Add the client IP address to the tenant allowlist for access control. |
| PrivateLink | Huawei Cloud | Endpoint security group | Configure a security group for the PrivateLink endpoint in the cloud vendor console. |
| PrivateLink | AWS | OB Cloud tenant allowlist | Add the client IP address to the allowlist. |
| Private network connection | Azure | OB Cloud tenant allowlist (one-part connection string) / No configuration required (two-part connection string) | Configure the allowlist when using a one-part connection string. |
| Peering connection | Huawei Cloud | OB Cloud tenant allowlist | Add the ECS/VM IP range of the peer VPC to the allowlist. |
Port description
Compatibility mode |
Default port |
Description |
|---|---|---|
| MySQL Compatible | 3306 | Used by JDBC, the mysql and obclient command-line clients, and other tools. |
| Oracle Compatible | 1521 | Used by jdbc:oceanbase:// and obclient. |
| KV Compatible | 3307 | The port used to connect to a KV tenant. |
Note
The actual port is subject to the connection string obtained from the console. Different tenants may use different ports.
Connection account format
The page for obtaining a connection string in the console automatically generates a correctly formatted connection string based on the selected connection method. We recommend copying and using it directly. For more information, see Connect to OceanBase Cloud using OBClient.
Access the database through a public IP address. This is suitable for local development and debugging, quick testing, or scenarios requiring cross-cloud vendor access. For detailed operations, see Connect to a database using a public IP address.
Procedure |
Action |
Description |
|---|---|---|
| 1 | Apply for a public IP address | Apply for a public IP address for the target tenant in the OceanBase Cloud console. |
| 2 | Configure tenant allowlist | Add the client outbound IP address to the tenant's allowlist (the console supports "Add Current Browser IP Address"). |
| 3 | Configure SSL certificate | Download the CA certificate and configure it on the client. For more information, see SSL encryption. |
| 4 | Configure network outbound rules | Make sure that TCP outbound traffic from the client to the public endpoint and port is not blocked (see the description below). |
| 5 | Obtain the connection string and test the connection | Create a database and an account, copy the connection string, and test the connection using the client. |
Note
- Local development machine: Usually no additional configuration is required; if the connection times out, check whether the local firewall or company network allows outbound TCP (such as 3306, 1521).
- Cloud-hosted ECS instance or VM: You must configure the instance security group to allow outbound TCP traffic to the port of the OceanBase Cloud public endpoint. Alibaba Cloud users can refer to Security Group Rules.
Perform the following checks to confirm that the public network connection is successful.
Check item |
Requirements |
|---|---|
| Public endpoint | Created and displayed in the console. |
| Tenant allowlist | The client egress IP address has been added. |
| SSL certificate | The CA certificate has been downloaded and configured if SSL is required. |
| Network outbound rules | The local firewall or ECS/VM security group allows access. |
| Database connection | The connection string generated by the console has passed the connection test. |
Access the database through a cloud vendor's private network channel. This is suitable for production environments where traffic does not need to go over the public network. The specific operations vary by cloud vendor.
Alibaba Cloud
Create a private network endpoint directly in the OceanBase Cloud console, without creating a separate endpoint in the cloud vendor's console. For detailed operations, see the corresponding subdocument.
Procedure |
Action |
Description |
|---|---|---|
| 1 | Create a private endpoint | In the OceanBase Cloud console, enter the Alibaba Cloud root account ID, VPC, and VSwitch to create a private endpoint. |
| 2 | Configure access control | Configure the tenant allowlist as needed. |
| 3 | Configure security group outbound rules | The application ECS/VM is in the same VPC as the private IP address, and the security group allows TCP outbound traffic to the port of the private IP address. |
| 4 | Obtain the connection string and test the connection | After the private IP address is created, select the database and account, copy the connection string, and test the connection. |
Perform the following checks to confirm that the Alibaba Cloud private network connection is successful.
Check item |
Requirements |
|---|---|
| Private endpoint | Created in the OceanBase Cloud console and in the Available state. |
| Network location | The application ECS/VM is in the same region, VPC, and VSwitch as the private endpoint. |
| ECS/VM security group | Allows outbound TCP traffic to the private endpoint port. |
| Database connection | The connection test is successful. |
AWS
First, create an endpoint service in OceanBase Cloud. Then, create an endpoint in the AWS console and enter the endpoint information in OceanBase Cloud. Finally, enable Private DNS and obtain the connection string. For detailed operations, see the corresponding subdocument.
Procedure |
Action |
Description |
|---|---|---|
| 1 | Create an endpoint service | Enter the AWS account ID in the OceanBase Cloud console to create an endpoint service. |
| 2 | Create an endpoint | Create an endpoint in the AWS console, associate it with the OceanBase Cloud service ID, and select a VPC and subnet. |
| 3 | Enter endpoint information | Enter the VPC endpoint ID in the OceanBase Cloud console. |
| 4 | Enable Private DNS | Enable Private DNS for the endpoint in the AWS console and confirm it in the OceanBase Cloud console. |
| 5 | Configure access control | Add the client IP address to the tenant allowlist. |
| 6 | Configure security group outbound rules | The application's EC2 security group allows TCP outbound traffic to the endpoint port. |
| 7 | Obtain the connection string and test the connection | After the endpoint is available, obtain the connection string in the console and test the connection. |
Perform the following checks to confirm that the AWS private network connection is successful.
Check item |
Requirements |
|---|---|
| Endpoint service | Created in the OceanBase Cloud console and in the Available state. |
| Endpoint | Created in the AWS console and in the Available state. |
| Endpoint information | The VPC endpoint ID has been entered in OceanBase Cloud. |
| Private DNS | Enabled in the AWS console and confirmed in the OceanBase Cloud console. |
| Tenant allowlist | The client IP address has been added. |
| Network location | The application EC2 instance is in the same region and VPC as the endpoint. |
| EC2 security group | Allows outbound TCP traffic to the endpoint port. |
| Database connection | The connection test is successful. |
Huawei Cloud
First, create an endpoint service in OceanBase Cloud. Then, create an endpoint in the Huawei Cloud console and enter the endpoint information in OceanBase Cloud. Finally, obtain the connection string. For detailed operations, see the corresponding subdocument.
Procedure |
Action |
Description |
|---|---|---|
| 1 | Create an endpoint service | Create an endpoint service on the network configuration page of the OB Cloud console. |
| 2 | Create an endpoint | Create an endpoint in the Huawei Cloud console and associate it with the OceanBase Cloud service ID. |
| 3 | Enter endpoint information | Enter the endpoint ID, IP address, and VPC ID in the OceanBase Cloud console. |
| 4 | Configure security group rules | The application ECS/VM security group must allow outbound TCP traffic to the endpoint IP address. The endpoint security group must also allow inbound traffic. |
| 5 | Obtain the connection string and test the connection | After the endpoint is available, obtain the connection string in the console and test the connection. |
Perform the following check to confirm that the private network connection is successful.
Check item |
Requirements |
|---|---|
| Endpoint service | Created in the OceanBase Cloud console and in the Available state. |
| Endpoint | Created in the Huawei Cloud console and in the Available state. |
| Endpoint information | The endpoint ID, IP address, and VPC ID have been entered in OceanBase Cloud. |
| Network location | The client ECS/VM and the endpoint are in the same region and VPC. |
| ECS/VM security group | Allows outbound TCP traffic to the endpoint IP address and port. |
| Endpoint security group | Allows inbound traffic from the IP address or IP range of the client ECS/VM. |
| Database connection | The connection test is successful. |
Related links:
Peering connections provided by the cloud vendor enable communication between VPCs within that cloud. Configure the peering connection in the OceanBase Cloud console rather than initiating it directly in the cloud vendor console. For detailed operations, see the corresponding subdocument.
Procedure |
Action |
Description |
|---|---|---|
| 1 | Create a peering connection in OceanBase Cloud | Fill in the customer VPC information on the network configuration page and create a peering connection. |
| 2 | Accept and configure routing on the cloud vendor side | Accept the peering connection request and add a route to the OceanBase Cloud IP range to the route table. |
| 3 | Configure tenant allowlist | Add the ECS/VM IP range of the customer's VPC to the tenant's allowlist. |
| 4 | Configure security group rules | Allow outbound and inbound TCP traffic to and from the peer VPC IP range and database ports. |
| 5 | Obtain the connection string and test the connection | After the peering connection is activated, obtain the connection string and test it. |
Perform the following check to confirm that the peering connection is successful.
Check item |
Requirements |
|---|---|
| Peering connection | Created in the OceanBase Cloud console, accepted by the cloud provider, and in the Connected state. |
| Route table | Configured with a destination in the OceanBase Cloud IP range. |
| Tenant allowlist | The ECS/VM IP range in the peer VPC has been added. |
| Security group | Allows TCP traffic to the peer VPC subnet and database port. |
| Database connection | The connection test is successful. |
Related links:
Connectivity verification and FAQ
After completing the network configuration, you can verify it as follows:
Port probing (optional): Execute
nc -zv <address> <port>ortelnet <address> <port>on the client to confirm that the TCP port is reachable. If the command is unavailable, skip this step and directly test with the database client.Database connection test: Use the connection string, account, and password generated by the console to connect. This is the most reliable verification method.
Symptom |
Possible causes |
Troubleshooting direction |
|---|---|---|
| Connection timeout | The allowlist is not configured, or the IP address is incorrect. | Confirm that the client egress IP has been added to the tenant's allowlist. |
| Connection timeout | The security group or firewall blocks the connection. | Check the ECS/VM security group outbound rules and the endpoint security group inbound rules. |
| Connection timeout | The private endpoint is not ready. | Confirm that the private endpoint is in the Available state in the OceanBase Cloud console. |
| Connection refused | The port or endpoint is incorrect. | Use the endpoint and port in the connection string generated by the console. |
| Access denied | Incorrect account format or password | Use the connection string generated by the console to confirm that the username format and password are correct. |
| SSL-related errors | No CA certificate is configured. | For public network connections, download and configure the CA certificate. For more information, see SSL encryption. |