# VPC Peering

Before you can make your very first connection to a TiDB Database you must setup VPC Peering in the DBaaS console.
You can check to see if you have a peering connection already under [TroubleShooting: Is the VPC Peering working?](#troubleshooting-peering).

If you are already peered see [TroubleShooting: test the connection to the database](#troubleshooting-connect).

## Troubleshooting

<a name="troubleshooting"></a>

#### Is the VPC Peering working?

<a name="troubleshooting-peering"></a>

You can look at the Peering status in the console.
Error messages for Peering don't necessarily show up in the console in the VPC peering error icon but instead may show up in the console notifications in the upper right of the screen.

You can also view the peering status with this gcloud command.
When you run this command, you should see `ACTIVE` and `Connected`:

```
gcloud compute networks peerings list | grep pingcap-tidb-<customer>
```


#### Peering success, how can I test the connection to the database?

<a name="troubleshooting-connect"></a>

You can do a quick test with curl to the PingCAP IP address from a VM in the same network and region as the TiDB IP address. If you can reach it, everything is working, and you will immediately see an error response because you are using curl:


```
> curl <address>:4000
5.7.10-TiDB-v...
```

If this command hangs, the setup is not working.

If you need to you can create an instance for testing with (you probably want to change subnet and zone):

```
gcloud beta compute instances create "user-$(whoami)" --subnet=us-west1 --zone=us-west1-b --machine-type=f1-micro --tags=user --image=ubuntu-1904-disco-v20190816 --image-project=ubuntu-os-cloud
```

You can then ssh with:

```
 gcloud compute ssh user-$(whoami)
gcloud compute firewall-rules create --network default  ssh-user --allow tcp:22 --target-tags=user
```

Please note that the above allows SSH access to this instance from anywhere (but requires your personal credentials).
When you are done with this testing, delete the instance with:

```
gcloud compute instances delete user-$(whoami)
```


#### I cannot connect, how can I troubleshoot this?

Make sure that your VM is in the peered network and in the same region as the TiDB cluster.

Verify the region by running this command on your VM:

```
> basename $(curl -s -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/zone) | cut -d - -f 1,2
<region>
```

Verify the instance is in the network that you peered by running this command on your VM:

```
> basename $(curl -s -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/network)
<network>
```


Make sure that your firewall rules allow for the connection.

```
gcloud compute firewall-rules list
```

You can see your peering routes (that should not be blocked by firewall rules) with

```
gcloud compute routes list --filter='name ~ ^peering'

```

Those routes should also not overlap with any of your existing routes.