Azure虚拟机Oracle 1521端口无法连通，其他端口正常求助

问题背景 #

在Azure中创建RHEL虚拟机并安装Oracle 19c数据库后，尝试通过Windows系统的Oracle SQL Developer连接失败。核心现象：

• Oracle服务运行正常，但lsnrctl status显示的监听地址与listener.ora配置的地址不一致
• Windows主机可连通虚拟机的22、80、443端口，但1521端口无法连通
• 已配置Windows防火墙入站规则，且Azure虚拟机侧开放了1521端口

现有配置详情 #

listener.ora配置

# listener.ora Network Configuration File: /opt/oracle/product/19c/dbhome_1/network/admin/listener.ora
# Generated by Oracle configuration tools.
SID_LIST_LISTENER =
  (SID_LIST =
    (SID_DESC =
           (GLOBAL_DBNAME = ORCLCDB)
           (ORACLE_HOME = /opt/oracle/product/19c/dbhome_1)
           (SID_NAME = ORCLCDB)
        )
)
LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = azurerhel.internal.cloudapp.net)(PORT = 1521))
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
    )
  )
ADR_BASE_LISTENER = /opt/oracle

tnsnames.ora配置

# tnsnames.ora Network Configuration File: /opt/oracle/product/19c/dbhome_1/network/admin/tnsnames.ora
# Generated by Oracle configuration tools.

ORCLCDB =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = azurerhel.internal.cloudapp.net)(PORT = 1521))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = ORCLCDB)
    )
  )

LISTENER_ORCLCDB =
  (ADDRESS = (PROTOCOL = TCP)(HOST = azurerhel.internal.cloudapp.net)(PORT = 1521))

监听状态输出

Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 19.0.0.0.0 - Production
Start Date                10-DEC-2022 06:23:21
Uptime                    6 days 7 hr. 14 min. 55 sec
Trace Level               off
Security                  ON: Local OS Authentication
SNMP                      OFF
Listener Parameter File   /opt/oracle/product/19c/dbhome_1/network/admin/listener.ora
Listener Log File         /opt/oracle/diag/tnslsnr/azureRHEL/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=azureRHEL.tolzstizeobujjzahdvcdkfbwa.rx.internal.cloudapp.net)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=azureRHEL.tolzstizeobujjzahdvcdkfbwa.rx.internal.cloudapp.net)(PORT=5500))(Security=(my_wallet_directory=/opt/oracle/admin/ORCLCDB/xdb_wallet))(Presentation=HTTP)(Session=RAW))
Services Summary...
Service "ORCLCDB" has 1 instance(s).
  Instance "ORCLCDB", status READY, has 1 handler(s) for this service...
Service "ORCLCDBXDB" has 1 instance(s).
  Instance "ORCLCDB", status READY, has 1 handler(s) for this service...
Service "ef748d50f3d7d6efe0530400000a867c" has 1 instance(s).
  Instance "ORCLCDB", status READY, has 1 handler(s) for this service...
Service "orclpdb1" has 1 instance(s).
  Instance "ORCLCDB", status READY, has 1 handler(s) for this service...
The command completed successfully

解决方案步骤 #

1. 修正Oracle监听绑定地址 #

监听地址不一致的原因是Oracle解析azurerhel.internal.cloudapp.net到了虚拟机的内部FQDN，导致监听仅绑定内部地址，外部无法访问。修改方式：

• 编辑listener.ora，将HOST改为虚拟机的公网IP（如果Windows在公网）、私网IP（如果Windows在Azure同一VNet）或者0.0.0.0（监听所有网卡地址）：

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = 0.0.0.0)(PORT = 1521))
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
    )
  )

• 重启监听服务：

lsnrctl stop
lsnrctl start

• 再次执行lsnrctl status确认监听地址已更新为0.0.0.0或指定IP

2. 检查并配置RHEL本地防火墙 #

RHEL默认启用firewalld，需确保1521端口已开放：

• 查看当前开放端口：

firewall-cmd --list-ports

• 若未看到1521/tcp，添加永久规则并重启防火墙：

firewall-cmd --add-port=1521/tcp --permanent
firewall-cmd --reload

3. 确认Azure网络安全组(NSG)规则 #

• 进入Azure Portal，找到虚拟机对应的NSG（需关联到虚拟机或子网）
• 检查入站规则，确保存在允许TCP 1521端口的规则，源地址设置为Windows主机的公网IP（或限定IP范围，避免全网开放）
• 注意：NSG规则优先级需高于默认的拒绝规则

4. 配置SQL Developer连接信息 #

在Windows的Oracle SQL Developer中，使用正确的连接参数：

• 连接名：自定义（如ORCLCDB_Azure）
• 用户名：Oracle数据库用户（如SYS、SYSTEM）
• 密码：对应用户密码
• 主机名：虚拟机的公网IP或公网FQDN（而非内部地址）
• 端口：1521
• 服务名：ORCLCDB（对应监听状态中的服务名）

5. 验证端口连通性 #

• 在Windows主机执行命令测试1521端口连通性：

Test-NetConnection <虚拟机公网IP> -Port 1521

或使用telnet：

telnet <虚拟机公网IP> 1521

• 在RHEL虚拟机确认端口监听状态：

netstat -tulpn | grep 1521

内容的提问来源于stack exchange，提问作者Mahesh Babu Tatineni