:What do I do if the "Can't connect to MySQL server on 'XXX'" error message is displayed when I connect to an ApsaraDB RDS for MySQL instance or an ApsaraDB RDS for MariaDB instance?

Resolve the "Can't connect to MySQL server on 'XXX'" error when connecting to an ApsaraDB RDS for MySQL or MariaDB instance over an internal network or the Internet.

Description

When you connect to an ApsaraDB RDS for MySQL instance or an ApsaraDB RDS for MariaDB instance, one of the following errors is displayed:

• ERROR 2003 (HY000): Can't connect to MySQL server on 'XXX'(10038, 10060, or 110)

• ERROR 2002 (HY000): Can't connect to MySQL server on 'XXX' (115)

• Cannot connect to a database: XXX

Solution

Follow the steps in the section that matches your connection path:

• ECS instance connecting over an internal network

• Non-ECS device connecting over the Internet

ECS instance connecting over an internal network

1. Check whether the ECS instance and the RDS instance are in the same region. If they are in different regions, resolve the issue based on the instructions in Troubleshoot ApsaraDB RDS for PostgreSQL connection failures

2. Check whether the ECS instance and the RDS instance use the same network type. If they use different network types, such as the classic network and virtual private cloud (VPC), resolve the issue based on the instructions in Troubleshoot ApsaraDB RDS for PostgreSQL connection failures

3. If both instances use the VPC network type, check whether they are in the same VPC. If they are in different VPCs, resolve the issue based on the instructions in Troubleshoot ApsaraDB RDS for PostgreSQL connection failures

4. Check whether the private IP address of the ECS instance is added to an IP address whitelist of the RDS instance. If not, add the IP address to an IP address whitelist of the RDS instance.

5. Check whether 0.0.0.0/0 is added to an IP address whitelist of the RDS instance.

   Note

   0.0.0.0/0 grants all devices access to the RDS instance, which poses security risks. Add this entry with caution.

6. If you have enabled the enhanced whitelist mode for the RDS instance, verify the following:

   1. If you use the VPC-type internal endpoint, make sure the private IP address of the ECS instance is added to the VPC-type IP address whitelist.

   2. If you use the classic network-type internal endpoint, make sure the private IP address of the ECS instance is added to the classic network-type IP address whitelist.

7. Check whether the internal endpoint and port number of the RDS instance are correctly configured on the ECS instance.

   Note

   A common mistake is adding the private IP address of the ECS instance to the whitelist but then using the public endpoint for the connection. Make sure you use the internal endpoint.

8. Check whether the CIDR block of the ECS instance or any services running on it (such as containers) conflicts with the CIDR block of the RDS instance. For more information, see The "Destination Host Unreachable" error message is displayed when I ping the endpoint of an RDS instance

Non-ECS device connecting over the Internet

Non-ECS devices can connect to an RDS instance only over the Internet. If the connection fails, check the following:

1. Check whether an IP address whitelist is configured for the RDS instance. If no whitelist is configured, configure an IP address whitelist.

2. Check whether 0.0.0.0/0 is added to the IP address whitelist. The valid format is 0.0.0.0/0.

   Note

   0.0.0.0/0 grants all devices access to the RDS instance, which poses security risks. Add this entry with caution.

3. If you have enabled the enhanced whitelist mode for the RDS instance, make sure the public IP address of the device is added to the classic network-type IP address whitelist.

   Note

   The VPC-type IP address whitelist does not apply to Internet-based connections.

4. If the device's IP address is already in the whitelist but the connection still fails, the public IP address you added may be incorrect. Common causes include:

   Note

   For more information about how to get the public IP address of a device, see Troubleshoot ApsaraDB RDS for PostgreSQL connection failures

   • The public IP address of the device changes dynamically.

   • The tool or website used to look up the public IP address returns an inaccurate result.

5. Check whether you are connecting with the internal endpoint of the RDS instance instead of the public endpoint. Non-ECS devices must use the public endpoint.

   Note

   • If the RDS instance does not have a public endpoint, apply for a public endpoint first.

   • Non-ECS devices and Data Management (DMS) cannot connect to the RDS instance using the internal endpoint, unless Express Connect circuits are used.

Applicable scope

• ApsaraDB RDS for MySQL

• ApsaraDB RDS for MariaDB