Granting access to the DBaaS instance – enabling network security rules to open ports on the Cloud Compute Node

After a database instance is provisioned in the DBaaS cloud service, it is not automatically accessible from services outside the identity domain. Various processes and applications running as part of the database instance can be accessed through specific ports – such as 1521 [the default] for SQL*Net access and 5500 [the default] for Enterprise Manager Database Express 12c. The next figure shows the situation after provisioning the DBaaS instance.

The DBaaS instance MyJCSDB – whose creation is described in this article – lives on a compute node (MyJCSDB db_1 1) created implicitly during database provisioning. It is at the level of this compute node that network access is arranged. A public IP address is allocated to the compute node – and that is the address to access the database and the applications associated with the database – such as Enterprise Manager 11g Database Control, Enterprise Manager Database Express 12c, GlassFish Server administration console, Oracle REST Data Services, Oracle Application Express, and the Oracle Cloud on-instance database monitor.

Initially, all these services are not accessible from outside the compute node. Explicit network security rules in the compute node have to be enabled – and sometimes defined – in order to make these services accessible. This instruction in the Oracle DBaaS documentation describes how to open up these ports and which network security rules to enable. As an example, let’s enable access to Enterprise Manager Database Express 12c. This means that port 5500 needs to be opened up.

Initially it is not:

Go to the service console for the compute node MyJCSDB db_1 1 on the Compute Cloud Service.

Click on the Network tab. Locate the network security rule ora_p2_dbexpress that governs access to port 5500. Click on the hamburger menu icon for this rule.

In the popup, choose the option Update.

In the popup that opens for the security rule, change the status to Enabled. Then press Update.

The rule is updated and a confirmation message appears.

At this point, port 5500 is opened on the compute node to the public internet.

That means we should now be able to access Enterprise Manager Database Express 12c for the MyJCSDB DBaaS instance.

The browser now wants us to acknowledge that we know what we are doing.

After adding the exception, the Database Express login dialog appears:

And we can start doing our administration things.

In a similar way, we can enable the network security rules to open up other ports, such as 80 and 443 for HTTP and HTTPS access (for ORDS, APEX and others) and 1521 for SQL*Net access for example to support JDBC connections.

Resources

See documentation Using Oracle Database Cloud – Database as a Service – Enabling Access to a Compute Node Port

.