Overview|OceanBase Cloud |docs|OceanBase Documentations

This topic describes the network connection configurations for OceanBase Cloud Flagship Edition instances and how to enable applications to connect to the database.

Prerequisites

You have registered an OceanBase Cloud account and created a cluster instance and tenant. For details, see Create a cluster instance and Create a tenant.
You have identified the application deployment location (local development machine, cloud-based ECS/VM, etc.) and the cloud provider, so that you can select an appropriate connection method.

Background information

After a tenant is created, applications cannot directly access the database. Typically, the following two types of configurations are required:

Access control: Restrict the IPs that can connect to the database.

The access control requirements vary by connection method:

Cloud provider	Connection method	Tenant allowlist required?	Access control description
All	Public network connection	Yes	Add the client's egress IP to the allowlist.
Alibaba Cloud	Private network connection	Yes	You must add the client IP to the tenant allowlist for access control.
Huawei Cloud	Private network connection (PrivateLink)	No	Controlled by the endpoint security group.
AWS	Private network connection (PrivateLink)	Yes	You must add the client IP to the allowlist.
Huawei Cloud, AWS	Peering connection	Yes	Add the ECS/VM IP range from the peer VPC to the allowlist.
Azure	Private network connection (one-part connection string)	Yes	Configure an allowlist when using a one-part connection string.
Azure	Private network connection (two-part connection string)	No	No configuration required.

Note

For connection methods that do not support IP allowlists, such as Huawei Cloud PrivateLink, the security group is the only access control measure.
For connection methods that support allowlists, such as AWS PrivateLink, you must also configure the security group correctly.

Network reachability: Make sure that the route between the client and the database endpoint is reachable and that intermediate firewalls and security groups allow TCP traffic on the corresponding ports.

Connection method overview

Connection method	Application scenarios	Whether a public endpoint is required	Configuration complexity	Supported cloud vendors
Public network connection	Local development and debugging, rapid testing, cross-cloud vendor access	Yes	Low	All
Private network connection	Production environments where traffic is not routed over the public network	No	Medium to high (varies by cloud vendor)	Alibaba Cloud, Huawei Cloud, AWS, Azure
Peering connection	Communication between VPCs within the same cloud provider	No	Medium	Huawei Cloud, AWS

Access control description

The configuration location for access control varies by connection method:

Connection method	Cloud vendor	Access control method	Description
Public network connection	All	OB Cloud tenant allowlist	Add the client outbound IP address to the allowlist.
Private network connection	Alibaba Cloud	OB Cloud tenant allowlist	Add the client IP address to the tenant allowlist for access control.
PrivateLink	Huawei Cloud	Endpoint security group	Configure a security group for the PrivateLink endpoint in the cloud vendor console.
PrivateLink	AWS	OB Cloud tenant allowlist	Add the client IP address to the allowlist.
Private network connection	Azure	OB Cloud tenant allowlist (one-part connection string) / No configuration required (two-part connection string)	Configure the allowlist when using a one-part connection string.
Peering connection	Huawei Cloud, AWS	OB Cloud tenant allowlist	Add the ECS/VM IP range of the peer VPC to the allowlist.

Port description

Compatibility mode	Default port	Description
MySQL Compatible	3306	Used by JDBC, the `mysql` and `obclient` command-line clients, and other tools.
Oracle Compatible	1521	Used by `jdbc:oceanbase://` and `obclient`.
KV Compatible	3307	The port used to connect to a KV tenant.

Note

The actual port is subject to the connection string obtained from the console. Different tenants may use different ports.

Connection account format

The page for obtaining a connection string in the console automatically generates a correctly formatted connection string based on the selected connection method. We recommend copying and using it directly. For more information, see Connect to OceanBase Cloud using OBClient.

Public network connection

Private network connection (Private Link)

Peering Connection

Access the database through a public IP address. This is suitable for local development and debugging, quick testing, or scenarios requiring cross-cloud vendor access. For detailed operations, see Connect to a database using a public IP address.

Procedure	Action	Description
1	Apply for a public IP address	Apply for a public IP address for the target tenant in the OceanBase Cloud console.
2	Configure tenant allowlist	Add the client outbound IP address to the tenant's allowlist (the console supports "Add Current Browser IP Address").
3	Configure SSL certificate	Download the CA certificate and configure it on the client. For more information, see SSL encryption.
4	Configure network outbound rules	Make sure that TCP outbound traffic from the client to the public endpoint and port is not blocked (see the description below).
5	Obtain the connection string and test the connection	Create a database and an account, copy the connection string, and test the connection using the client.

Note

Local development machine: Usually no additional configuration is required; if the connection times out, check whether the local firewall or company network allows outbound TCP (such as 3306, 1521).
Cloud-hosted ECS instance or VM: You must configure the instance security group to allow outbound TCP traffic to the port of the OceanBase Cloud public endpoint. Alibaba Cloud users can refer to Security Group Rules.

Perform the following checks to confirm that the public network connection is successful.

Check item	Requirements
Public endpoint	Created and displayed in the console.
Tenant allowlist	The client egress IP address has been added.
SSL certificate	The CA certificate has been downloaded and configured if SSL is required.
Network outbound rules	The local firewall or ECS/VM security group allows access.
Database connection	The connection string generated by the console has passed the connection test.

Access the database through a cloud vendor's private network channel. This is suitable for production environments where traffic does not need to go over the public network. The specific operations vary by cloud vendor.

Alibaba Cloud

Create a private network endpoint directly in the OceanBase Cloud console, without creating a separate endpoint in the cloud vendor's console. For detailed operations, see the corresponding subdocument.

Procedure	Action	Description
1	Create a private endpoint	In the OceanBase Cloud console, enter the Alibaba Cloud root account ID, VPC, and VSwitch to create a private endpoint.
2	Configure access control	Configure the tenant allowlist as needed.
3	Configure security group outbound rules	The application ECS/VM is in the same VPC as the private IP address, and the security group allows TCP outbound traffic to the port of the private IP address.
4	Obtain the connection string and test the connection	After the private IP address is created, select the database and account, copy the connection string, and test the connection.

Perform the following checks to confirm that the Alibaba Cloud private network connection is successful.

Check item	Requirements
Private endpoint	Created in the OceanBase Cloud console and in the Available state.
Network location	The application ECS/VM is in the same region, VPC, and VSwitch as the private endpoint.
ECS/VM security group	Allows outbound TCP traffic to the private endpoint port.
Database connection	The connection test is successful.

AWS

First, create an endpoint service in OceanBase Cloud. Then, create an endpoint in the AWS console and enter the endpoint information in OceanBase Cloud. Finally, enable Private DNS and obtain the connection string. For detailed operations, see the corresponding subdocument.

Procedure	Action	Description
1	Create an endpoint service	Enter the AWS account ID in the OceanBase Cloud console to create an endpoint service.
2	Create an endpoint	Create an endpoint in the AWS console, associate it with the OceanBase Cloud service ID, and select a VPC and subnet.
3	Enter endpoint information	Enter the VPC endpoint ID in the OceanBase Cloud console.
4	Enable Private DNS	Enable Private DNS for the endpoint in the AWS console and confirm it in the OceanBase Cloud console.
5	Configure access control	Add the client IP address to the tenant allowlist.
6	Configure security group outbound rules	The application's EC2 security group allows TCP outbound traffic to the endpoint port.
7	Obtain the connection string and test the connection	After the endpoint is available, obtain the connection string in the console and test the connection.

Perform the following checks to confirm that the AWS private network connection is successful.

Check item	Requirements
Endpoint service	Created in the OceanBase Cloud console and in the Available state.
Endpoint	Created in the AWS console and in the Available state.
Endpoint information	The VPC endpoint ID has been entered in OceanBase Cloud.
Private DNS	Enabled in the AWS console and confirmed in the OceanBase Cloud console.
Tenant allowlist	The client IP address has been added.
Network location	The application EC2 instance is in the same region and VPC as the endpoint.
EC2 security group	Allows outbound TCP traffic to the endpoint port.
Database connection	The connection test is successful.

Huawei Cloud

First, create an endpoint service in OceanBase Cloud. Then, create an endpoint in the Huawei Cloud console and enter the endpoint information in OceanBase Cloud. Finally, obtain the connection string. For detailed operations, see the corresponding subdocument.

Procedure	Action	Description
1	Create an endpoint service	Create an endpoint service on the network configuration page of the OB Cloud console.
2	Create an endpoint	Create an endpoint in the Huawei Cloud console and associate it with the OceanBase Cloud service ID.
3	Enter endpoint information	Enter the endpoint ID, IP address, and VPC ID in the OceanBase Cloud console.
4	Configure security group rules	The application ECS/VM security group must allow outbound TCP traffic to the endpoint IP address. The endpoint security group must also allow inbound traffic.
5	Obtain the connection string and test the connection	After the endpoint is available, obtain the connection string in the console and test the connection.

Perform the following check to confirm that the private network connection is successful.

Check item	Requirements
Endpoint service	Created in the OceanBase Cloud console and in the Available state.
Endpoint	Created in the Huawei Cloud console and in the Available state.
Endpoint information	The endpoint ID, IP address, and VPC ID have been entered in OceanBase Cloud.
Network location	The client ECS/VM and the endpoint are in the same region and VPC.
ECS/VM security group	Allows outbound TCP traffic to the endpoint IP address and port.
Endpoint security group	Allows inbound traffic from the IP address or IP range of the client ECS/VM.
Database connection	The connection test is successful.

Related links:

Peering connections provided by the cloud vendor enable communication between VPCs within that cloud. Configure the peering connection in the OceanBase Cloud console rather than initiating it directly in the cloud vendor console. For detailed operations, see the corresponding subdocument.

Procedure	Action	Description
1	Create a peering connection in OceanBase Cloud	Fill in the customer VPC information on the network configuration page and create a peering connection.
2	Accept and configure routing on the cloud vendor side	Accept the peering connection request and add a route to the OceanBase Cloud IP range to the route table.
3	Configure tenant allowlist	Add the ECS/VM IP range of the customer's VPC to the tenant's allowlist.
4	Configure security group rules	Allow outbound and inbound TCP traffic to and from the peer VPC IP range and database ports.
5	Obtain the connection string and test the connection	After the peering connection is activated, obtain the connection string and test it.

Perform the following check to confirm that the peering connection is successful.

Check item	Requirements
Peering connection	Created in the OceanBase Cloud console, accepted by the cloud provider, and in the Connected state.
Route table	Configured with a destination in the OceanBase Cloud IP range.
Tenant allowlist	The ECS/VM IP range in the peer VPC has been added.
Security group	Allows TCP traffic to the peer VPC subnet and database port.
Database connection	The connection test is successful.

Related links:

Connectivity verification and FAQ

After completing the network configuration, you can verify it as follows:

Port probing (optional): Execute nc -zv <address> <port> or telnet <address> <port> on the client to confirm that the TCP port is reachable. If the command is unavailable, skip this step and directly test with the database client.
Database connection test: Use the connection string, account, and password generated by the console to connect. This is the most reliable verification method.

Symptom	Possible causes	Troubleshooting direction
Connection timeout	The allowlist is not configured, or the IP address is incorrect.	Confirm that the client egress IP has been added to the tenant's allowlist.
Connection timeout	The security group or firewall blocks the connection.	Check the ECS/VM security group outbound rules and the endpoint security group inbound rules.
Connection timeout	The private endpoint is not ready.	Confirm that the private endpoint is in the Available state in the OceanBase Cloud console.
Connection refused	The port or endpoint is incorrect.	Use the endpoint and port in the connection string generated by the console.
Access denied	Incorrect account format or password	Use the connection string generated by the console to confirm that the username format and password are correct.
SSL-related errors	No CA certificate is configured.	For public network connections, download and configure the CA certificate. For more information, see SSL encryption.