[Yandex Cloud documentation](../../../index.md) > [Yandex MPP Analytics for PostgreSQL](../../index.md) > [Step-by-step guides](../index.md) > Connection > Pre-configuration

# Pre-configuring a Yandex MPP Analytics for PostgreSQL cluster connection

A Yandex MPP Analytics for PostgreSQL cluster can be used to deploy a Greenplum® or Apache Cloudberry™ DBMS. Both DBMSs are based on PostgreSQL, so you need the same tools as for PostgreSQL to connect to them.

You can only connect to a Yandex MPP Analytics for PostgreSQL cluster through the [primary master host](../../concepts/index.md). To identify host roles, get a [list of hosts in the cluster](../cluster-list.md#get-hosts).

You can connect to a cluster:

* From Yandex Cloud virtual machines located in the same [cloud network](../../../vpc/concepts/network.md). For hosts without public access, SSL is not required to connect to them from these virtual machines.
* Over the internet if you configured public access for your cluster. You can connect over the internet in the following ways:

  * Use an SSL connection.
  * Use IAM authentication.


## Configuring security groups {#configuring-security-groups}

You can assign one or more security groups to a Yandex MPP Analytics for PostgreSQL cluster. To connect to a cluster, security groups must include rules allowing traffic on port 6432 from certain IP addresses or other security groups.

{% note info %}

A security group assigned to a cluster controls traffic between the cluster and other cloud or external resources. You do not need to configure interaction between cluster hosts, as it is controlled by a separate system security group.

{% endnote %}

Rule settings depends on the connection method you select:

{% list tabs group=connection_method %}

- Over the internet {#internet}

    1. For incoming traffic:
    
       * **Port range**: `6432`.
       * **Protocol**: `TCP`.
       * **Source**: `CIDR`.
       * **CIDR blocks**: Range of addresses to connect from.
    
    1. For outgoing traffic:
    
       * **Port range**: `0-65535`.
       * **Protocol**: `Any` (`Any`).
       * **Source**: `CIDR`.
       * **CIDR blocks**: `0.0.0.0/0`.
    
       This rule enables Yandex MPP Analytics for PostgreSQL to use external data sources, e.g., PXF or GPFDIST.

- From a VM in Yandex Cloud {#cloud}

    1. Add the following rules to the cluster security group:

        1. For incoming traffic:

            * **Port range**: `6432`.
            * **Protocol**: `TCP`.
            * **Source**: `Security group`.
            * **Security group**: If your cluster and VM share the same security group, select `Current`. Otherwise, specify the VM security group.

         1. For outgoing traffic:

            * **Port range**: `0-65535`.
            * **Protocol**: `Any`.
            * **Source**: `CIDR`.
            * **CIDR blocks**: `0.0.0.0/0`.

            This rule enables Yandex MPP Analytics for PostgreSQL to use external data sources, e.g., PXF or GPFDIST.

    1. [Configure the VM security group](../../../vpc/operations/security-group-add-rule.md) to allow connections to the VM as well as traffic between the VM and the cluster hosts.

        * For inbound traffic:
            * **Port range**: `22`.
            * **Protocol**: `TCP`.
            * **Source**: `CIDR`.
            * **CIDR blocks**: Range of addresses to connect from.

            This rule allows VM connections over SSH.

        * For outbound traffic:
            * **Port range**: `0-65535`.
            * **Protocol**: `Any`.
            * **Destination name**: `CIDR`.
            * **CIDR blocks**: `0.0.0.0/0`.

            This rule permits all outbound traffic, allowing you to install any necessary certificates and tools on your VM.

{% endlist %}


### Security groups for Yandex Managed Service for Trino {#sg-for-trino}

To access the Greenplum® cluster, the Trino [connector](../../../managed-trino/concepts/greenplum-connector.md) uses the GPFDIST protocol:

* Trino coordinators and workers send queries to the Greenplum® master over TCP port `6432`.
* Greenplum® segments forward data to Trino workers over the GPFDIST TCP port.

Data transmitted between the Greenplum® and Trino clusters over the GPFDIST protocol is unencrypted. To secure your connection, configure security groups [in Yandex MPP Analytics for PostgreSQL](#configuring-security-groups-greenplum) and, optionally, [in Managed Service for Trino](#configuring-security-groups-trino).

If Greenplum® interacts with other clusters or entities inside the user network, you need to separately configure security group rules for any such clusters or entities.

#### Greenplum® side setup {#configuring-security-groups-greenplum}

{% list tabs group=traffic %}

- Incoming traffic {#incoming}

    * Rule for internal Greenplum® cluster traffic:

        * **Port range**: `0-65535`.
        * **Protocol**: `Any`.
        * **Source**: `Security group`.
        * **Security group**: `Current`.

    * Rule for connections from a Trino cluster:

        * **Port range**: `6432`.
        * **Protocol**: `TCP`.
        * **Source**: `Security group`.
        * **Security group**: Specify the Trino cluster security group.

- Outgoing traffic {#outgoing}

    * Rule for internal Greenplum® cluster traffic:

        * **Port range**: `0-65535`.
        * **Protocol**: `Any`.
        * **Source**: `Security group`.
        * **Security group**: `Current`.

    * Rule for connections to a Trino cluster:

        * **Port range**: `0-65535`.
        * **Protocol**: `TCP`.
        * **Source**: `Security group`.
        * **Security group**: Specify the Trino cluster security group.

{% endlist %}

#### Managed Service for Trino side setup {#configuring-security-groups-trino}

To configure security group rules in Trino, invert the Greenplum® rule settings. Setting up rules for a Trino cluster is optional, but this provides added security for your cluster.

{% list tabs group=traffic %}

- Incoming traffic {#incoming}

  Rule for receiving data from Greenplum® segments:

    * **Port range**: `0-65535`.
    * **Protocol**: `TCP`.
    * **Source**: `Security group`.
    * **Security group**: Specify the Greenplum® cluster security group.

- Outgoing traffic {#outgoing}

  Rule for connections to a Greenplum® master:

    * **Port range**: `6432`.
    * **Protocol**: `TCP`.
    * **Source**: `Security group`.
    * **Security group**: Specify the Greenplum® cluster security group.

{% endlist %}


## Obtaining an SSL certificate {#get-ssl-cert}

To use an SSL connection, get a certificate:

{% list tabs group=operating_system %}

- Linux (Bash)/macOS (Zsh) {#linux-macos}

   ```bash
   mkdir -p ~/.postgresql && \
   wget "https://storage.yandexcloud.net/cloud-certs/CA.pem" \
        --output-document ~/.postgresql/root.crt && \
   chmod 0655 ~/.postgresql/root.crt
   ```

   The certificate will be saved to the `~/.postgresql/root.crt` file.

- Windows (PowerShell) {#windows}

   ```powershell
   mkdir $HOME\.postgresql; curl.exe -o $HOME\.postgresql\root.crt https://storage.yandexcloud.net/cloud-certs/CA.pem
   ```

   The certificate will be saved to the `$HOME\.postgresql\root.crt` file.

   Your corporate security policies and antivirus software may block the certificate download. For more information, see [FAQ](../../qa/connection.md#get-ssl-error).

{% endlist %}

To use graphical IDEs, [save a certificate](https://storage.yandexcloud.net/cloud-certs/RootCA.pem) to a local folder and specify the path to it in the connection settings.

## What's next {#whats-next}

* [Get the FQDN of the host](fqdn.md) you want to connect to.
* [Connect](clients.md) to the cluster from a graphical IDE, pgAdmin 4 or Docker container.
* [Integrate](code-examples.md) the cluster connection into your application code.

_Greenplum® and Greenplum Database® are registered trademarks or trademarks of Broadcom Inc. in the United States and/or other countries._

_Apache® and Apache Cloudberry™ are registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries._