Resolve instance connection issues - AnalyticDB - Alibaba Cloud Documentation Center

Connection failures when connecting to an AnalyticDB for PostgreSQL instance from a client are almost always caused by one of two things: the client IP address is a local area network (LAN) IP that the instance cannot reach, or the client IP is not in the instance's IP address whitelist.

The following steps walk you through adding a temporary open rule to identify your client's actual IP address, then locking it down.

Prerequisites

Before you begin, ensure that you have:

Access to the AnalyticDB for PostgreSQL console
The psql client tool installed. See Use client tools to connect to an instance for download instructions.

Find and allowlist your client IP address

Step 1: Temporarily allow all IP addresses

Log on to the AnalyticDB for PostgreSQL console.
In the upper-left corner, select the region where the instance resides.
Click the instance ID. The Basic Information page appears.
In the left-side navigation pane, click Security Controls.
On the Whitelist Settings tab, click Modify next to the default IP address whitelist. The Modify Whitelist panel appears.
In the IP Addresses field, delete 127.0.0.1 and enter 0.0.0.0/0.
Click OK.

0.0.0.0/0 allows all IP addresses to access the instance. This may raise security risks. Remove it after you identify your client IP address.

Step 2: Connect to the instance using psql

Run the following command to connect:

psql -h yourgpdbaddress.gpdb.rds.aliyuncs.com -p 3432 -d postgres -U gpdbaccount

Parameter	Description
`-h`	Host (endpoint of the instance)
`-p`	Port used to connect to the database
`-d`	Database name. The default value is `postgres`.
`-U`	Account used to connect to the database

Run psql --help to see all available options, or \? for commands available inside psql.

Step 3: Query your client IP address

After connecting, run the following query in the SQL command line window:

select * from pg_stat_activity;

The CLIENT_ADDR column in the results shows your client's IP address.

Step 4: Replace the open rule with your client IP

In the Security Controls page, open the default IP address whitelist and click Modify.
Delete 0.0.0.0/0 and enter the IP address from the CLIENT_ADDR field.
Click OK.

Your client can now connect to the instance with a properly scoped whitelist entry.