Question: I want to use a database client (preferably DBeaver) to connect remotely to a MySQL server installed on a Google Cloud Provider VM.

I have created a Compute Engine VM instance running Debian 9, and have installed MySQL server.

The VM must be accessed through the primary internal IP. We have our own network with a sub-network.

Answer: 
You can use Google Cloud IAP to create a TCP tunnel to your instance and connect securely to instances that have do not have public IP addresses.

From your desktop execute this command to start the tunnel. Edit the command and replace the parameters that are in capital letters with your setup.

Windows syntax. For Linux replace `^` with `&` at the end of each line.

```
gcloud compute start-iap-tunnel INSTANCE_NAME 3306 ^
--local-host-port=localhost:3306 ^
--zone=INSTANCE_ZONE ^
--project=PROJECT_ID

```

Create a firewall rule allowing the Cloud IAP netblock: `35.235.240.0/20`. I typically allow all ports, which allows me to tunnel any port that I require such as SSH.

Now you can connect to localhost on port 3306. The connection will be tunneled to your instance.

If you replace 3306 with 22, you can tunnel SSH to your instance.
2020 Update: you can do port forwarding as described [here](https://cloud.google.com/solutions/connecting-securely#port-forwarding-over-ssh). On your laptop run:

```
gcloud compute ssh YOUR_INSTANCE_NAME \
--project YOUR_PROJECT_NAME \
--zone YOUR_INSTANCE_ZONE \
-- -L 3306:localhost:3306

```

After that you can connect to your remote MySQL using DBeaver on localhost:3306