connect ENETUNREACH on Render with Supabase

Why does it work on my machine and fail on Render?

Render's guide says Supabase's direct connection uses IPv6 unless the project has the paid IPv4 add-on, and that Render does not support outbound IPv6, so a Render service cannot reach an IPv6-only host. Your own machine may have an IPv6 route that the Render service does not. Render suggests running dig on the database host from your own machine: if it returns only an IPv6 address, switch to the shared pooler or buy the add-on. Node.js prints the address it tried and the local side. This is the output from pg 8.23.1 in a container with no IPv6 route, aimed at a documentation address.

dig +short A db.[PROJECT-REF].supabase.co
dig +short AAAA db.[PROJECT-REF].supabase.co

connect ENETUNREACH 2001:db8::1:5432 - Local (:::0)
  code: 'ENETUNREACH', errno: -101, syscall: 'connect', port: 5432

Should I use port 5432 or 6543 on the pooler?

Both ports on the shared pooler host work over IPv4. Supabase says the shared pooler is IPv4-only on every plan, in session and transaction mode. Render recommends transaction mode (6543) for web services, cron jobs and autoscaled services, and session mode (5432) for background workers or any code that holds a connection and relies on state tied to it. Session mode and the direct connection both use port 5432, so check the host as well as the port when you copy a string. Changing only the port on db.<project-ref>.supabase.co does not help: Supabase says port 6543 reaches the dedicated pooler or the shared pooler depending on the host, and Render says the dedicated pooler is IPv6 by default.

Transaction mode does not support prepared statements. Render says to turn off server-side prepared statements in your driver or ORM when you use port 6543.

# direct host, IPv6: fails from Render
postgresql://postgres:[YOUR-PASSWORD]@db.[PROJECT-REF].supabase.co:5432/postgres
# shared pooler, session mode
postgresql://postgres.[PROJECT-REF]:[YOUR-PASSWORD]@aws-[INDEX]-[REGION].pooler.supabase.com:5432/postgres
# shared pooler, transaction mode
postgresql://postgres.[PROJECT-REF]:[YOUR-PASSWORD]@aws-[INDEX]-[REGION].pooler.supabase.com:6543/postgres

Can I keep the direct connection?

Yes, with the paid IPv4 add-on. Render's guide says a Render service can use the direct connection only with the add-on, and to run dig again afterwards to confirm the host returns an A record. Supabase says the add-on replaces the project's IPv6 record with an IPv4 record, so it is not dual-stack. The shared pooler costs nothing extra.

Checklist

How to fix it, then check the fix

1. 01In the Render dashboard, open the service Environment tab and look at the host in DATABASE_URL. db.<project-ref>.supabase.co is the direct host.
2. 02In Supabase, open Connect and copy the shared pooler string. Copy the host from the dialog: it follows aws-[INDEX]-[REGION].pooler.supabase.com, and the index is not always 0. The user is postgres.<project-ref>.
3. 03Pick the mode for the workload: 6543 (transaction) for a web service, 5432 (session) for a worker or code that needs session state. On 6543, turn off prepared statements in the driver or ORM.
4. 04Paste the string into DATABASE_URL. Then use Save, rebuild, and deploy or Save and deploy: Render says Save only does not deploy, and the service does not use the new variables until its next deploy.
5. 05Open the deploy logs: the app connects to the database and no line shows ENETUNREACH.

Related

Related guides

• SupabaseRailwayconnect ENETUNREACHGuide
• SupabaseVercelWhy does my Vercel app hit "Max client connections reached" on Supabase?Guide
• RenderPort scan timeout reached, no open ports detectedGuide

Sources

Official docs behind this checklist

• Render, How to connect a Render service to Supabase Postgres
• Supabase, Connect to your database
• Render, Environment variables and secrets
• Render, Troubleshooting deploys

FAQ

FAQ for builders before launch