22 days ago
Project: kickintel, environment: production, service: Postgres
Symptom: All external/public access to our Postgres database is unreachable, while internal/private network access works perfectly fine.
Evidence gathered:
TCP proxy connections (zephyr.proxy.rlwy.net:18525, and a freshly-regenerated tokaido.proxy.rlwy.net:43327 after removing/re-adding it) both complete the TCP handshake but the actual Postgres protocol exchange never responds — psql reports connection ... failed: timeout expired after a bounded wait.
Regenerating the TCP proxy domain entirely (delete + re-add) did not resolve it — same failure on the brand-new endpoint.
The dashboard's built-in Database query console fails with: Postgres WebSocket tunnel failed to connect (wss://ssh.railway.com:2226/ws/tcpip).
Meanwhile, our deployed app (kickgrid-website, using the internal postgres.railway.internal connection) is serving live production traffic against this same database with no issues.
This points to a problem specifically in Railway's external-access layer for this database (TCP proxy backend + WebSocket tunnel relay), not the Postgres instance itself, which appears healthy. Could you check the proxy/tunnel routing for this service?
2 Replies
22 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 22 days ago
21 days ago
Are you using correct DATABASE_PUBLIC_URL to connect?
21 days ago
good triage, and yeah when the tcp handshake completes but the postgres protocol never answers, the proxy edge is accepting but cant reach the db backend - thats railways relay layer, especially since the dashboard console fails the same way. only staff can fix that part.
but two things worth checking to rule out your side, and one workaround:
check the tcp proxy target port actually points at 5432. after delete + re-add its worth confirming it didnt attach to the wrong port.
in the postgres service check listen_addresses is still * and not pinned to the private interface, if it only listens on the private network the proxy backend cant complete the connection even though internal traffic is fine.
workaround while its broken: deploy a tiny socat service in the same project that forwards to the db over the private network, socat TCP-LISTEN:5432,fork TCP:postgres.railway.internal:5432, and put a tcp proxy on that service instead. different service = different proxy route, and since internal networking works fine for you, that gives you external access again without touching the db.