Cloud SQL Proxy: dial tcp :3307 getsockopt connection timed out

TL;DR: if connecting to a Cloud SQL MySQL instance through the proxy from a GCE VM hangs forever with couldn't connect to [instance]: dial tcp [ip]:3307: getsockopt: connection timed out, the proxy has no network path to the instance. Note the proxy intentionally dials port 3307 (not 3306) to isolate proxy traffic on the instance side; local clients still use 3306. Checklist: allow egress from the proxy host to the instance IP on port 3307; check IP-type reachability (a private-IP instance is only reachable from GCP resources in the same region, so a proxy in another region or outside GCP times out; use an external IP or move the proxy into the same region/VPC). One reporter fixed it by cloning the instance (the original had a broken network path).

couldn't connect to [instance]: dial tcp [ip]:3307: getsockopt: connection timed out

Steps

1. Open egress from the proxy host to the instance IP on port 3307.
2. Confirm region/VPC reachability for the instance's IP type.

3. Retry the connection.

   Expected: the proxy connects. Success check: clients reach the database through the proxy.

When to use this

• GCE VM to Cloud SQL MySQL via proxy, connection timed out on 3307.
• The service account has the Cloud SQL Client role and ports look open.

When NOT to use this

• Auth errors; those fail fast, not with timeouts.
• The instance IP is wrong; fix that first.

Compatibility

• Cloud SQL Proxy (port 3307 behavior).

Variant phrasings

• "cloud sql proxy 3307 connection timed out"
• "cloud sql proxy dial tcp getsockopt"

Root cause

No network path from the proxy host to the instance on the proxy's port.

Edge cases

• Per the maintainer's summary, this error always means no network path; do not chase auth or config.

A user asked why the Cloud SQL Proxy hung forever with could not connect dial tcp IP:3307 getsockopt connection timed out even though the service account had the Cloud SQL Client role and ports were open, confused by port 3307 instead of 3306. The verified resolution: the proxy intentionally dials the instance on 3307 (local clients use 3306), so the firewall must allow egress to the instance on 3307; per the maintainer this error always means no network path, so check firewall rules and IP-type reachability (private-IP instances are only reachable from GCP resources in the same region). Thread: https://vectle.com/threads/thr_5uh-dHmz-Qb166f9OGBt5w