Skip to main content

Connect to database with Floating IP

Connecting to a database takes two things: network access and credentials. You open access with a Security Group, and add a Floating IP if the client sits outside the VPC.

Work through the three sections below in order. If your client already runs inside the VPC, you can skip the Floating IP section.

Prerequisites​

  • A database in Running status. See Create your first database.
  • Permission to manage Security Groups and Floating IPs in the VPC.
  • A database client, CLI, or driver for your engine.

Create a Security Group​

A Security Group is a set of firewall rules controlling inbound and outbound traffic for a database. Each rule names the ports, protocols, and IP addresses or CIDR ranges allowed.

Follow these recommendations, which limit how far a misconfiguration can reach:

  • Use a dedicated Security Group for each database.
  • Open only the ports you need.
  • Avoid sharing one Security Group across databases, and avoid opening all ports. Overly permissive rules widen the attack surface and make a later rule change affect databases you did not intend to touch.

To create one:

  1. Log in to FPT Cloud Portal.

  2. From the main menu, select Network → Security Groups.

  3. Click Create security group.

    Create New Security Group form with name, instances, tags, and rules

  4. Fill in the fields:

    • Name: up to 50 characters, containing letters, numbers, and hyphens. The system can generate one for you.
    • Applied Instances (optional): the database instance the group applies to.
    • Add tag (optional): key-value tags for classification, cost management, and auditing.
    • Configure security rule (optional): inbound rules control connections into the database and take allowed sources in the Source field. Outbound rules control connections out of it and take destinations in the Destination field. Internal-only communication usually needs no outbound rule.

  5. Click Create security group.

The new group appears in the list with its name, applied nodes, and creation time.

Rename or delete a Security Group​

On the Security Group Management page, select Rename next to a group to change its name, or Delete to remove it. Confirm in the dialog.

warning

Deleting a Security Group removes all its rules immediately, which can cut network connectivity for any database still using it. Check that no resources depend on it before you delete.

Assign a Floating IP​

A Floating IP is a static public IPv4 address you attach to a database for external access. It only works if your Security Group rules already allow the traffic.

tip

Assign a Floating IP only when you need public access. For traffic that stays inside the VPC, use private addressing and keep the database off the public internet.

  1. From the main menu, select Network → Floating IPs.

  2. Click Allocate IP address.

    Allocate IP address dialog with address, resource, and port fields

  3. Fill in the fields:

    • IP address: choose Allocate new from pool to take a new address, or Existing IP to reuse one you already hold.
    • Resources: set the resource type to Instance, then select the target database instance.
    • IP Port (optional): the public port, for port forwarding or custom NAT rules. Leave blank for the default.
    • Instance port (optional): the private port on the instance that incoming traffic maps to. Leave blank for the default.
    • Add tag (optional): key-value tags for operations and auditing.

  4. Click Allocate floating IP.

The address appears in the list with Active status, attached to the instance you selected.

To release an address you no longer need, select Release IP for it and confirm.

If the Floating IP does not work as expected, check the Security Group inbound rules first. The required database port is the usual omission.

Connect with a client​

Once network access is open, connect using any standard client for your engine, such as pgAdmin for PostgreSQL or MySQL Workbench for MySQL.

Find the connection details​

Open the database detail page and read them from the Overview tab.

Database Overview tab showing endpoint, port, and credentials

You need:

  • Domain endpoint: the address to connect to.
  • Port: the port the engine listens on.
  • Database name: the default database created during provisioning.
  • Username: the administrative account.
  • Password: that account's password.

Establish the connection​

Connect in whichever way suits your workflow:

  • A management tool such as pgAdmin, MySQL Workbench, or SSMS. Supply the endpoint, port, username, password, and database name.
  • The command line, using the CLI for your engine from a terminal or application server.
  • An application, using the official driver for the engine and a connection string.

Once connected, you can browse the database structure and run queries.

note

If the connection times out, the cause is almost always network policy rather than credentials. Confirm the Security Group, firewall rules, and network policies all permit traffic to the endpoint and port.

Next steps​