All Products
Search

This Product

    :ECS fails to connect to the RDS instance due to routing issues

    Document Center

    :ECS fails to connect to the RDS instance due to routing issues

    Last Updated:Jun 16, 2026

    An ECS instance in the same VPC and region as an RDS instance cannot connect to the RDS instance over the internal network due to route table changes caused by services such as Docker.

    Description

    The ECS and RDS instances are in the same VPC and region, but the ECS instance cannot connect to the RDS instance over the internal network. The connection succeeds over the Internet address, but both ping and telnet to the internal address fail.

    Causes

    Installing services such as Docker modified the route table entries on the ECS instance, causing internal network traffic to be routed incorrectly.

    solution

    Important

    Alibaba Cloud reminds you that:

    • Before you perform operations that may cause risks, such as modifying instance configurations or data, we recommend that you check the disaster recovery and fault tolerance capabilities of the instances to ensure data security.

    • You can modify the configurations and data of instances including but not limited to Elastic Compute Service (ECS) and Relational Database Service (RDS) instances. Before the modification, we recommend that you create snapshots or enable RDS log backup.

    • If you have authorized or submitted security information such as the logon account and password in the Alibaba Cloud Management Console, we recommend that you modify such information in a timely manner.

    1. Log on to the ECS instance and run the following command to ping the internal endpoint of the RDS instance. 

      ping rm-XXX-mysql.rds.aliyuncs.com

      The output shows that the internal IP address of the RDS instance can be resolved, but the ping request times out.

    2. Run the following command to check the route table of the ECS instance: 

      route -n

      If the output contains a route entry added by Docker or another service, this entry may be directing traffic away from the correct gateway. You can compare the output with the route table of a working ECS instance to confirm.

    3. Run the following command to add the correct route entry. 

      route add -net [$Network] gw [$Gateway] dev [$Network_Card]
      Note

      • Verify that adding this route entry does not affect your running workloads before you proceed.

      • [$Network] is the CIDR block where the RDS instance is located.

      • [$Gateway] is the gateway address of the ECS instance. Use the internal gateway of the ECS instance.

      • [$Network_Card] is the name of the network interface on the ECS instance, typically eth0.

    4. Run the following command to verify that ping now succeeds: 

      ping rm-XXX-mysql.rds.aliyuncs.com

    Applicability

    • ECS

    • RDS