What I want to set:

• Cloud SQL instance with private IP, Postgresql database
• A VM with a public IP and one private IP on the same VPC network as the SQL instance (VM, SQL instance and VPC are all in the same region)
• The VM's service account has sufficient Cloud SQL client/viewer permissions
• Possibility to connect to SQL instance from VM.

What's wrong?

• Any attempt to actually use the connection (e.g. from the psql client or db-migrate) will hang - e.g. psql --host 10.78.0.3 -U gcp-network-issue-demo-staging-db-user gcp-network-issue-demo-staging-databasenot prompt for a password, just sit there.
• If I remove the VM's public IP address from the settings, the connection works fine. However, I need a publicly accessible VM that other services can connect to.

I'm assuming the psql connection attempt is going through the wrong network interface or something (it's probably just my ignorance of network stuff) - how do I get this to work? What am I missing?

PS: This is basically the same issue as failing to connect to a Google Cloud SQL instance on a private IP from a VM with a private IP and a public IP , but the commenters there seem to want a Terraform related question as well as a connection to problem related issues.

Some screenshots:

VM IP:

Database IP:

VM's network configuration:

Private IP configuration for the DB instance:

Here are the settings for the private network:

I don't understand why the private IP of the DB instance (10.78.0.3) is not an IP from the range of the private network (10.2.0.0-10.2.0.24, right?)..? Is that my problem?