IssueTracker

My configuration :
* I have a project "VPN", with a Cloud VPN to my onpremise network.
    The VPC contains several subnet which are part of 10.X.0.0/16, and is shared.
    In the VPN I allow traffic from my On-premise network 10.0.0.0/8 to 10.X.0.0/16

    I manually created the IP range "google-managed-services-my-vpc"  in 10.X.128.0/20 (/20 as requested in doc)
   
* I have a guest project "SQL" which is attached to the VPN projet for Shared VPC.
     In this project I created the Cloud SQL with private IP (from shared VPC)  - Type = 2nd gen, MYSQL_5.7
     Public IP is disabled.
     The Cloud SQL received an IP in the range google-managed-services-my-vpc.

Working items :
* From a compute engine in the project SQL, I'm able to connect to the Cloud SQL using the private IP.
* From a compute engine in the project VPN, I'm also able to connect to Cloud SQL using the private IP.
* From a compute engine in the shared VPC, via cloudsql-proxy, I'm able to connect to the instance.

Not working items :
* From a server on-premise, I'm not able to connect to the Cloud SQL using the private IP.
       After 2 min, mysql command line returns "ERROR 2003 (HY000): Can't connect to MySQL server on '10.X.128.3' (110)

* From a server on-premise, I'm not able to connect to the Cloud SQL using the private IP via cloudsql-proxy.
      After 2 min, mysql command line returns "ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 0"
     In Cloud SQL proxy I have :
2019/02/15 17:08:29 Rlimits for file descriptors set to {&{8500 8500}}
2019/02/15 17:08:29 using credential file for authentication; email=sql@SQL.iam.gserviceaccount.com
2019/02/15 17:08:29 Listening on 127.0.0.1:3306 for SQL:europe-west3:sql1
2019/02/15 17:08:29 Ready for new connections
2019/02/15 17:08:37 New connection for "SQL:europe-west3:sql1"
2019/02/15 17:10:45 couldn't connect to "SQL:europe-west3:sql1": dial tcp 10.243.128.3:3307: connect: connection timed out

I first think of an issue on firewall rules, so I allowed the traffic from 10.0.0.0/8 to port 3306 and 3307.
It didn't solve the issue.

I also check on the firewall on premise, I see the traffic going through the VPN but no answers.


What I want :
* being able to connect to Cloud SQL using the private IP through Cloud VPN.


Workaround
* not using private ip
* keep private and public IP for Cloud SQL, and use cloudsql proxy.

Best regards
Laurent