An incorrectly configured IP whitelist can cause database connection failures.
Verify the IP whitelist configuration
You can use Telnet to verify if the IP whitelist is configured correctly. A successful connection returns output similar to the following:
$telnet 11.xxx.xxx.22 4444
Trying 11.xxx.xxx.22...
Connected to 11.xxx.xxx.22.
Escape character is '^]'.
N
5.7.32-logc"B%0f7%0`I++'EVdWSB3mysql_native_password
^]If the client receives a MySQL handshake message from the database service and the message displays the MySQL version number (such as 5.7.32 in the preceding output), the IP whitelist is configured correctly. Otherwise, the IP whitelist is misconfigured. To fix this, see Set Whitelists (moved to parent) to correctly configure the whitelist.
Troubleshoot incorrect IP whitelist configurations
When connecting to a database cluster, first verify connectivity to the primary IP address. If the primary IP address is unreachable, the issue is likely caused by the IP whitelist. You can use Telnet or the tcpdump tool to identify the specific cause.
Incorrect whitelist for Enterprise Edition public VIP
-
Symptom: When you try to access the public virtual IP address (VIP) of an Enterprise Edition cluster, the Telnet connection fails with a timeout:
[xxx /xxx/gitlab/aegis/src] $telnet 11.xxx.xxx.93 3306 Trying 11.xxx.xxx.93... -
If you capture packets on the client, you will see that the client repeatedly retransmits the SYN message of the TCP three-way handshake.
Incorrect whitelist for Enterprise VPC and Standard endpoints
-
Symptom: When you access the VPC endpoint of an Enterprise Edition cluster or any endpoint (public or VPC) of a Standard Edition cluster, the Telnet connection is established, but the client does not receive the MySQL handshake message.
[xxx /u01/mysql80_current] $telnet 11.xxx.xxx.22 4444 Trying 11.xxx.xxx.22... Connected to 11.xxx.xxx.22. Escape character is '^]'. -
If you capture packets on the client, you will see repeated retransmissions of the SYN-ACK and final ACK messages during the TCP three-way handshake.
Resolve IP whitelist issues
As a temporary test, add the 0.0.0.0/0 CIDR block to the whitelist and try to access your service. A successful connection confirms an incorrect whitelist configuration.
You must then add the correct entries to the whitelist and remove the temporary 0.0.0.0/0 CIDR block. For instructions on how to configure the whitelist, see Set Whitelists (moved to parent).