Private Service Connect

```
{
  ...
  "privateDnsHostname": "xxxxxxx.<region code>.p.gcp.clickhouse.cloud"
}
```

In this example, connection to the `xxxxxxx.yy-xxxxN.p.gcp.clickhouse.cloud` hostname will be routed to Private Service Connect. Meanwhile, `xxxxxxx.yy-xxxxN.gcp.clickhouse.cloud` will be routed over the internet.

## Troubleshooting[​](#troubleshooting "Direct link to Troubleshooting")

### Test DNS setup[​](#test-dns-setup "Direct link to Test DNS setup")

DNS\_NAME - Use `privateDnsHostname` from [Obtain GCP service attachment for Private Service Connect](#obtain-gcp-service-attachment-and-dns-name-for-private-service-connect) step

```
nslookup $DNS_NAME
```

```
Non-authoritative answer:
...
Address: 10.128.0.2
```

### Connection reset by peer[​](#connection-reset-by-peer "Direct link to Connection reset by peer")

- Most likely, the Endpoint ID wasn't added to the service allow-list. Revisit the [*Add endpoint ID to services allow-list* step](#add-endpoint-id-to-services-allow-list).

### Test connectivity[​](#test-connectivity "Direct link to Test connectivity")

If you have problems connecting using a PSC link, check your connectivity using `openssl`. Make sure the Private Service Connect endpoint status is `Accepted`:

OpenSSL should be able to connect (see CONNECTED in the output). `errno=104` is expected.

DNS\_NAME - Use `privateDnsHostname` from [Obtain GCP service attachment for Private Service Connect](#obtain-gcp-service-attachment-and-dns-name-for-private-service-connect) step

```
openssl s_client -connect ${DNS_NAME}:9440
```

```
# highlight-next-line
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 335 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
```

### Checking endpoint filters[​](#checking-endpoint-filters "Direct link to Checking endpoint filters")

#### REST API[​](#rest-api "Direct link to REST API")

```
curl --silent --user "${KEY_ID:?}:${KEY_SECRET:?}" -X GET -H "Content-Type: application/json" "https://api.clickhouse.cloud/v1/organizations/${ORG_ID:?}/services/${INSTANCE_ID:?}" | jq .result.privateEndpointIds
[
  "102600141743718403"
]
```

### Connecting to a remote database[​](#connecting-to-a-remote-database "Direct link to Connecting to a remote database")

Let's say you're trying to use the [MySQL](/docs/sql-reference/table-functions/mysql) or [PostgreSQL](/docs/sql-reference/table-functions/postgresql) table functions in ClickHouse Cloud and connect to your database hosted in GCP. GCP PSC can't be used to enable this connection securely. PSC is a one-way, unidirectional connection. It allows your internal network or GCP VPC to connect securely to ClickHouse Cloud, but it doesn't allow ClickHouse Cloud to connect to your internal network.

According to the [GCP Private Service Connect documentation](https://cloud.google.com/vpc/docs/private-service-connect):

> Service-oriented design: Producer services are published through load balancers that expose a single IP address to the consumer VPC network. Consumer traffic that accesses producer services is unidirectional and can only access the service IP address, rather than having access to an entire peered VPC network.

To do this, configure your GCP VPC firewall rules to allow connections from ClickHouse Cloud to your internal/private database service. Check the [default egress IP addresses for ClickHouse Cloud regions](/docs/manage/data-sources/cloud-endpoints-api), along with the [available static IP addresses](https://api.clickhouse.cloud/static-ips.json).

## More information[​](#more-information "Direct link to More information")

For more detailed information, visit [cloud.google.com/vpc/docs/configure-private-service-connect-services](https://cloud.google.com/vpc/docs/configure-private-service-connect-services).

- [Attention](#attention)- [Before you get started](#before-you-get-started)- [Obtain GCP service attachment and DNS name for Private Service Connect](#obtain-gcp-service-attachment-and-dns-name-for-private-service-connect)
      - [Option 1: ClickHouse Cloud console](#option-1-clickhouse-cloud-console)- [Option 2: API](#option-2-api)- [Create service endpoint](#create-service-endpoint)
        - [Adding a private service connection](#adding-a-private-service-connection)- [Set private DNS name for endpoint](#set-private-dns-name-for-endpoint)- [Add Endpoint ID to ClickHouse Cloud organization](#add-endpoint-id-to-clickhouse-cloud-organization)
            - [Option 1: ClickHouse Cloud console](#option-1-clickhouse-cloud-console-1)- [Option 2: API](#option-2-api-1)- [Add "Endpoint ID" to ClickHouse service allow list](#add-endpoint-id-to-services-allow-list)
              - [Option 1: ClickHouse Cloud console](#option-1-clickhouse-cloud-console-2)- [Option 2: API](#option-2-api-2)- [Accessing instance using Private Service Connect](#accessing-instance-using-private-service-connect)
                - [Getting private DNS hostname](#getting-private-dns-hostname)- [Troubleshooting](#troubleshooting)
                  - [Test DNS setup](#test-dns-setup)- [Connection reset by peer](#connection-reset-by-peer)- [Test connectivity](#test-connectivity)- [Checking endpoint filters](#checking-endpoint-filters)- [Connecting to a remote database](#connecting-to-a-remote-database)- [More information](#more-information)

Was this page helpful?