Cannot connect to Azure PostgreSQL Database flexible server from VM on same VNet

Question

Cannot connect to Azure PostgreSQL Database flexible server from VM on same VNet

Serafin Achurra 5

I cannot connect to an Azure PostgreSQL Database flexible server from VM on same VNet. The database server has the following configuration:

require_secure_transport = OFF
Connectivity method = Private access
Subscription = Same Subscription as the VM
Virtual network = Same VNet as the VM
Subnet: Different subnet since the subnet has to be delegated for use only with PostgreSQL Flexible Server
Private DNS zone

The VM has the following configuration:

Ubuntu LTS 22.04 with TLS 1.2
Connected to a load balancer with inbound NAT rules for ports 80, 22, and 5432, however I read that requests sent from the same VNet do not go through the load balancer.
I've installed all necessary packages and can successfully execute the following command: psql postgres://reader:******@hh-pgsql-public.ebi.ac.uk:5432/pfmegrnargs

The VNet has the following configuration:

DB Subnet with Microsoft.Storage and Micrososft.Sql services endpoints selected. Private endpoint network policy is set to Network security groups
VM Subnet with Micrososft.Sql services endpoints selected. Private endpoint network policy is set to Network security groups
Both subnets are in the same network security group
No firewall
Default DNS server

The private DNS zone has the following settings:

1 virtual network link
Link status = Completed
Auto-Registration = Enabled
1 "SOA" record set
1 "A" record which was not auto-registered. I assume this is the IP of the DB. I tried the psql command with the IP but this did not work

When I run the psql command to the PostgreSQL DB the command hangs. I tried using the IP, FQDN, Private DNS zone name, and record set name of the record which appears to be the DB. I noticed when I look at the Connected Devices of the VNet I see the VM but not the DB even though the DB is on a different subnet of the same VNet.

Serafin Achurra 5 Reputation points

2023-04-02T18:34:04.28+00:00

I can confirm that if I use the telnet command on port 5432 to the PostgreSQL server it returns the following:

I can confirm that if I use the netstat command, port 5432 is not active:

1 answer

Your answer

Serafin Achurra 5 Reputation points

2023-04-02T18:34:04.28+00:00

I can confirm that if I use the telnet command on port 5432 to the PostgreSQL server it returns the following:

I can confirm that if I use the netstat command, port 5432 is not active:

Answer 1

risolis 8,741

Hello @Serafin Achurra

Thank you for posting this concern on this community space.

I have read your whole case scenario description and I just wanted to double confirm your post request below:

-Are you referring to this feature at the Vnet level Subnet Delegation (Vnet Injection)?

-Do you set up any Private Link?

-Do you set up any Service Endpoint?

-Do you have custom DNS settings or the Default ones?

Looking forward to your feedback,

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Serafin Achurra 5 Reputation points

2023-04-02T18:46:23.5266667+00:00

Hi Risolis, thanks for your response!

Yes I am referring to the Vnet level subnet delegation

I did try using a Private Link but this did not resolve my issue. I also read later the following

https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking#private-access-vnet-integration

I do have Service Endpoints setup on the PostgreSQL Subnet (see above screenshot) and VM Subnet:

I am using the Default DNS settings on the VNet
Serafin Achurra 5 Reputation points

2023-04-02T18:47:40.7233333+00:00

FYI, I added a comment on my post with screenshots of network troubleshooting commands that I tried.
risolis 8,741 Reputation points

2023-04-02T18:55:57.5733333+00:00

Many thanks for your answer.

I saw your previous comment which is a great detail about it.

Now what I am wondering is which type of connection are you trying to do?

I saw your telnet output but is this like Frontend/backend tier network design or are you just testing connectivity buddy?

Looking forward to your feedback,

Cheers,
Serafin Achurra 5 Reputation points

2023-04-02T18:59:38.7266667+00:00

Yes I am trying to setup a Frontend/backend tier network with a Django Ubuntu 22.04 and Azure PostgreSQL Database flexible server. At the moment I am in the early stages of an app development. This is why I have not setup HTTPS or SSL certificates from the DB to Ubuntu VM. I also have require_secure_transport = OFF.
risolis 8,741 Reputation points

2023-04-02T19:14:41.25+00:00

Great info!

Now I wonder if you have the DB username and password and try something like this:

sqlcmd -S <remoteip> -U <user> -p -Q "SELECT @@VERSION"

Password:

Also, did you check listening ports like 1433,1434, 3306 and so on?
Serafin Achurra 5 Reputation points

2023-04-02T19:25:51.99+00:00

I tried the sqlcmd and it hangs just like the psql command. This is what is most confusing because both sqlcmd and psql commands do not give any error like Connection failed or invalid password.

I used the netstat command on the Ubuntu VM and it shows the following ports are listening:

My understanding is the PostgreSQL uses port 5432.

https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking
risolis 8,741 Reputation points

2023-04-02T19:48:43.7166667+00:00

Buddy

I would like to gather the following info for you to try it:

systemctl start mysqld.service

/usr/bin/mysqladmin -u root password 'password'

systemctl enable mysqld.service

systemctl status mysqld.service

ufw allow proto tcp from x.x.x.x to any port 3306

mysql -u username -p'password' -h <IP_ADDRESS_OF_MYSQL_OR_MARIADB_SERVER or FQDN> -e STATUS

mysql -u username -p 'password' -h <IP_ADDRESS_OF_MYSQL_OR_MARIADB_SERVER or FQDN> -e STATUS ;

mysql -u username -p 'password' -h <IP_ADDRESS_OF_MYSQL_OR_MARIADB_SERVER or FQDN> mysql -e "select * from servers;"

mysql -u username -p 'password' -h <IP_ADDRESS_OF_MYSQL_OR_MARIADB_SERVER or FQDN> -e "select * from general_log;"
risolis 8,741 Reputation points

2023-04-02T19:49:46.0466667+00:00

Thank you for the previous details about the port and all of that.
Serafin Achurra 5 Reputation points

2023-04-02T20:42:45.14+00:00

When running systemctl start mysqld.service

I get Failed to start mysqld.service. I am trying to use PostgreSQL not MySQL.

I have ufw disabled on the Ubuntu server.
risolis 8,741 Reputation points

2023-04-02T21:50:57.92+00:00

Sorry about it those were some personal notes but try this:

-restart your psql process first, if you made changes and then run this:

psql -h [ip address] -p [port] -d [database] -U [username]

Share via

Cannot connect to Azure PostgreSQL Database flexible server from VM on same VNet

1 answer

Your answer