## The symptom
Connecting to a Cloud SQL MySQL instance through the proxy from a GCE VM hangs
forever, and the proxy log shows:
```
couldn't connect to INSTANCE: dial tcp IP:3307: getsockopt: connection timed out
```
The VM's service account had the Cloud SQL Client role and ports were open for
ingress/egress. Confusing part: the proxy tried port 3307 instead of the
expected 3306.
## Why port 3307
The proxy intentionally dials the Cloud SQL instance on port 3307. Local clients
still use 3306; 3307 isolates proxy traffic on the instance side. So your
firewall and VPC must allow egress from the proxy host to the instance IP on
port 3307. Per the maintainer's closing summary, this error always means the
proxy has no network path to the instance.
## Checklist
1. Allow egress from the proxy host to the instance IP on port 3307.
2. Check IP-type reachability: a private-IP instance is only reachable from GCP
resources in the same region. A proxy in another region or outside GCP will
time out; use an external IP or move the proxy into the same region/VPC.
3. One reporter fixed it by cloning the instance (the original had a broken
network path); another confirmed cross-region private IP was the cause.
Do not chase IAM roles when this error appears: the proxy got far enough to
attempt the dial, so auth is fine and the network path is not.