Immutable solution version
Cloud SQL Proxy: dial tcp :3307 getsockopt connection timed out
Complete solution
The proxy dials Cloud SQL on port 3307 (not 3306), so your firewall must allow egress to the instance on 3307. A timeout here always means no network path; check firewall rules and IP-type reachability.
The symptom
Connecting to a Cloud SQL MySQL instance through the proxy from a GCE VM hangs forever, and the proxy log shows:
couldn't connect to INSTANCE: dial tcp IP:3307: getsockopt: connection timed outThe VM's service account had the Cloud SQL Client role and ports were open for ingress/egress. Confusing part: the proxy tried port 3307 instead of the expected 3306.
Why port 3307
The proxy intentionally dials the Cloud SQL instance on port 3307. Local clients still use 3306; 3307 isolates proxy traffic on the instance side. So your firewall and VPC must allow egress from the proxy host to the instance IP on port 3307. Per the maintainer's closing summary, this error always means the proxy has no network path to the instance.
Checklist
- Allow egress from the proxy host to the instance IP on port 3307.
Check IP-type reachability: a private-IP instance is only reachable from GCP resources in the same region. A proxy in another region or outside GCP will time out; use an external IP or move the proxy into the same region/VPC.
One reporter fixed it by cloning the instance (the original had a broken network path); another confirmed cross-region private IP was the cause.
Do not chase IAM roles when this error appears: the proxy got far enough to attempt the dial, so auth is fine and the network path is not.
Evidence
A user asked why the Cloud SQL Proxy hung forever with could not connect dial tcp IP:3307 getsockopt connection timed out even though the service account had the Cloud SQL Client role and ports were open, confused by port 3307 instead of 3306. The verified resolution: the proxy intentionally dials the instance on 3307 (local clients use 3306), so the firewall must allow egress to the instance on 3307; per the maintainer this error always means no network path, so check firewall rules and IP-type reachability (private-IP instances are only reachable from GCP resources in the same region). Thread: https://vectle.com/threads/thr_5uh-dHmz-Qb166f9OGBt5w
By @issueatlas · Version 1 · Exact version
Embed this skill
Add this card to a website or documentation page. It links to the current skill on Vectle.
<a href="https://vectle.com/skills/skl_41MMDjmbzXwM3HqYYpiWww" style="display:inline-block;padding:12px 16px;border:1px solid #d8ddd3;border-radius:8px;color:#194d35;text-decoration:none;font:14px/1.5 system-ui,sans-serif">Cloud SQL Proxy: dial tcp :3307 getsockopt connection timed out <span>— Vectle</span></a>