How to resolve errors when connecting a database instance to DTS over VPN

Important notes

If your database instance uses an Alibaba Cloud VPN gateway and you have additional questions or requirements about the VPN while troubleshooting, contact VPN gateway technical support. For more information, see What is a VPN gateway.

Procedure

1. Collect information about the source or destination instance where the error occurred.

   The collected instance information appears in the following table:

   Parameter	Description
   Instance Region	The region where the self-managed database instance resides.
   The VPC that has been connected to the source database	The ID of the virtual private cloud (VPC) to which the self-managed database instance is connected.
   IP address	The private IP address of the self-managed database instance.
   Port Number	The service port of the self-managed database instance.

2. Obtain the CIDR blocks of DTS servers in the instance region.

   In the document Add DTS server IP addresses to the whitelist or , obtain the list of DTS server CIDR blocks based on the region of the instance and the database connection type.

3. Check the security settings of the self-managed database instance.

   Add all obtained DTS server CIDR blocks to the security settings of the self-managed database instance to allow access from DTS servers. These settings include but are not limited to the following:

   • Security groups of the self-managed database

   • Firewall of the self-managed database

   • Whitelist of the self-managed database instance

4. Check whether the on-premises to cloud routing is complete.

   1. Log on to the VPC console. In the navigation pane on the left, click Route tables.

   2. Set VPC ID to the value you collected for The VPC that has been connected to the source database to filter route tables.

   3. Click the instance ID of the target route table and check the Destination CIDR block for your on-premises data center in the Custom route entry tab of the Route entries list.

      • If you use a self-managed VPN, all traffic destined for your on-premises data center CIDR block must point to the ECS instance in your VPC. The Next hop must be the ECS instance ID.

      • If you use a VPN gateway, all traffic destined for your on-premises data center CIDR block must point to the VPN gateway.

5. Check whether the IPsec tunnel of the VPN is correctly configured.

   • If you use a self-managed VPN, check your IPsec tunnel configuration and test the connection. If the connection still fails, capture packets at both ends of your VPN to check whether DTS traffic (with a source IP from the DTS service CIDR block) passes through your VPN.

   • If you use a VPN gateway, follow these steps to check your IPsec tunnel configuration.

     1. Log on to the VPC console.

     2. In the navigation pane on the left, choose Interconnectivity > VPN > IPsec Connections.

     3. Set Routing mode to Policy-based.

     4. Add all obtained DTS server CIDR blocks to Local network.

     5. Add the IP address of your on-premises data center to Remote network.

     6. Apply the updated VPN and routing configurations to your on-premises gateway device.

        Note

        For more information, see Connect an on-premises data center to DTS over a VPN gateway.

     7. Test the connection. If it still fails, contact VPN gateway technical support to capture packets at both ends of your VPN and check whether DTS traffic (with a source IP from the DTS service CIDR block) passes through your VPN.

6. Verify that cloud routing is correctly configured.

   Check whether return traffic from your on-premises instance is routed through this VPN tunnel. If your database instance resides on another cloud provider's platform, contact that provider's technical support for assistance.

7. Check for VPC route conflicts.

   If the issue persists after performing the preceding checks, contact VPC technical support to check for route conflicts with DTS cloud services.