What do I do if I am unable to connect to an ApsaraDB RDS instance and the

Problem description

You cannot ping the internal endpoint of the RDS instance from an Elastic Compute Service (ECS) instance, and Destination Host Unreachable is returned.

PING rm-bpxxxx.mysql.rds.aliyuncs.com (172.17.0.31) 56(84) bytes of data.
From xxxx (172.17.0.1) icmp_seq=1 Destination Host Unreachable
From xxxx (172.17.0.1) icmp_seq=2 Destination Host Unreachable
From xxxx (172.17.0.1) icmp_seq=3 Destination Host Unreachable

Causes

In most cases, the internal CIDR block of the RDS instance conflicts with the CIDR block of another service.

Analysis

Run the PING command to ping the internal endpoint of the RDS instance to view its private IP address. In the preceding example, the private IP address of the RDS instance is 172.17.0.31.
This example uses a Linux operating system. Run the route-n command to view the routes. Output similar to the following is returned:
```
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.17.2.253    0.0.0.0         UG    0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
172.17.0.0      0.0.0.0         255.255.255.0   U     0      0        0 br-350b446c181a
```
The output shows that the CIDR block of the network interface card (NIC) br-350b446c181a is 172.17.0.0/24, which conflicts with the private IP address of the RDS instance. As a result, the ECS instance cannot route traffic to the RDS instance.

In most cases, this issue occurs because the CIDR block of the container service conflicts with the CIDR block of ApsaraDB RDS. The following example uses a container service to describe how to resolve a route conflict.

Solutions

Solution 1: Modify the default CIDR block of the container service

Important

Stopping Docker or modifying the default CIDR block of Docker interrupts your services. Perform this operation during off-peak hours.
When you modify the default CIDR block of Docker, make sure that it is compatible with the network settings of all existing containers and applications to prevent potential connectivity issues.

This example uses a Linux operating system. Perform the following steps:

Stop the Docker service.
```
sudo systemctl stop docker
```
Edit the Docker configuration file. In most cases, the Docker configuration file is located at /etc/docker/daemon.json or /etc/docker/daemon.conf. The file name may vary.
```
sudo vim /etc/docker/daemon.json
```
Make sure that the file contains the following content:
```
{
    "bip": "New CIDR block"
}
```
For example, set the new CIDR block to 192.168.0.0/16.
Save and close the configuration file.
Start the Docker service for the changes to take effect.
```
sudo systemctl start docker
```

Solution 2: Change the vSwitch of the RDS instance

You can change the vSwitch of the RDS instance so that the vSwitch CIDR block does not conflict with the CIDR block of the container service.