Here’s the complete solution for resolving Autonomous Database connection timeouts from compute instances using private endpoints:
1. Security List Configuration - Compute Subnet:
The compute instance subnet’s security list needs an egress rule to allow database traffic to the Autonomous Database private endpoint subnet.
Egress Rule:
Destination: <ADB-Private-Endpoint-Subnet-CIDR> (e.g., 10.0.2.0/24)
Protocol: TCP
Destination Port Range: 1521-1522
Description: Allow ADB connections to private endpoint subnet
If using mutual TLS (mTLS), port 1522 is required. For TLS connections without wallet, port 1521 is sufficient. Including both ports (1521-1522) covers all connection types.
2. Security List Configuration - ADB Private Endpoint Subnet:
This is the critical configuration often missed. The private endpoint subnet’s security list must have an ingress rule allowing traffic from the compute subnet.
Ingress Rule:
Source: <Compute-Subnet-CIDR> (e.g., 10.0.1.0/24)
Protocol: TCP
Destination Port Range: 1521-1522
Description: Allow database connections from compute subnet
Without this ingress rule, the private endpoint will reject connection attempts, causing timeouts.
3. Subnet and Route Table Setup:
For subnets in the same VCN, local routing should work automatically. However, verify:
a) Both subnets are in the same VCN (check VCN OCID)
b) Route tables on both subnets include local VCN routes
Default route table configuration:
Destination: <VCN-CIDR> (e.g., 10.0.0.0/16)
Target: Local
Description: Local VCN routing
If you’re using custom route tables, ensure they don’t override local VCN routing. The presence of a default route (0.0.0.0/0) to an Internet Gateway shouldn’t affect local VCN traffic, but verify no more specific routes conflict.
4. Private Endpoint Association Verification:
Confirm the Autonomous Database is correctly associated with the private endpoint:
- Navigate to Autonomous Database → Network
- Verify ‘Access Type’ is set to ‘Private endpoint access only’
- Note the ‘Private Endpoint Subnet’ OCID
- Check ‘Private Endpoint IP Address’ (this is the IP your compute instances will connect to)
If the private endpoint isn’t properly configured, connections will always fail regardless of security list rules.
5. Connection String and TNS Configuration:
Ensure your tnsnames.ora or connection string uses the private endpoint hostname:
adb_service = (DESCRIPTION=
(ADDRESS=(PROTOCOL=TCP)(HOST=<private-endpoint-hostname>)(PORT=1521))
(CONNECT_DATA=(SERVICE_NAME=<service_name>))
)
The private endpoint hostname is different from the public endpoint. Find it in the Autonomous Database connection details under ‘Private Endpoint’ section.
6. Network Security Groups (NSGs) - If Applicable:
If your compute instances or ADB private endpoint use NSGs instead of security lists, configure similar rules in the NSGs:
Compute Instance NSG - Egress:
Destination: <ADB-Private-Endpoint-Subnet-CIDR>
Protocol: TCP
Port: 1521-1522
ADB Private Endpoint NSG - Ingress:
Source: <Compute-Subnet-CIDR>
Protocol: TCP
Port: 1521-1522
NSGs take precedence over security lists, so both must be configured if NSGs are attached.
7. Testing Connectivity:
After configuring security lists and verifying route tables:
a) Test network connectivity from compute instance:
telnet <private-endpoint-ip> 1521
# Should connect successfully
b) Test TNS connectivity:
tnsping adb_service
# Should resolve and respond
c) Test database connection:
sqlplus admin/password@adb_service
8. Troubleshooting Persistent Timeouts:
If connection timeouts persist:
- Verify security list changes have propagated (can take 1-2 minutes)
- Check if Network Security Groups are overriding security list rules
- Confirm the private endpoint IP address matches the one in your connection string
- Review VCN flow logs to identify where packets are being dropped
- Ensure no firewall rules on the compute instance OS level block outbound port 1521/1522
- Verify the Autonomous Database is in ‘Available’ state (not stopped or scaling)
9. Common Mistakes to Avoid:
- Using public endpoint connection strings when private endpoint is configured
- Forgetting to add ingress rules on the ADB private endpoint subnet (most common issue)
- Mixing up subnet CIDRs in security list rules
- Not including both ports 1521 and 1522 (some connection types require 1522)
- Assuming ‘Allow All’ egress rules on compute subnet are sufficient (ingress rules on ADB subnet are still required)
The root cause of your connection timeout is almost certainly the missing ingress security list rule on the Autonomous Database private endpoint subnet. Adding this rule to allow TCP ports 1521-1522 from your compute subnet CIDR will resolve the timeout issue. The combination of proper security list configuration on both subnets, correct route table setup for local VCN routing, and verified private endpoint association will enable successful database connections from your compute instances.