The network I'm using doesn't allow port 3306 so I can't connect to Google Cloud SQL. How do I set up a proxy server (on a different network that allows 3306) that I could connect to via SSH to communicate with GCS directly using Navicat/MySQL Workbench?
To expand on Dan's answer with some detailed info:
If you have the option setup a small Linux server at home. You might have to modify the sshdconfig to allow for setting up SSH tunnels depending on your release. You might also need to modify the firewall config to allow port 22 connections, though most distributions do this automatically now when you install openssh.
You can use a dynamic DNS service in case your home IP address changes and you can still access remotely. For that I actually prefer to use freedns.afraid.org and setup a sub-domain off of a publicly available domain they host. Then added a cron job on my Linux server to run once per hour and hit a special link that keeps the IP for that sub-domain updated. Many home WiFi routers actually support one or more dynamic DNS services directly within the config.
You'll need to setup a port forward on your home router as well. Setup an external connection port forwarded to your Linux server's IP address on port 22. The specifics of doing this is highly dependent on which router you're using.
IMPORTANT Whatever you do don't setup the port forward to expose port 22 externally. Hackers/Script-Kiddies constantly scan for port 22. When they find it they'll start trying to hack root's password. You'll notice this happening if you look in /var/log/secure and see the file is huge. I did this once and within just a few hours I saw connections and hack attempts already occurring.
So use a non-standard port (like 5828 or something else equally as random). Just keep it above 1024 and below 32767.
On Windows a very good SSH client is PuTTY (www.chiark.greenend.org.uk/~sgtatham/putty). In the connection setup put your internet hostname (from either the dynamic DNS service you chose or through the freedns service I mentioned). Set your port to the one you chose in your port forward.
Then go to the SSH/Tunnels section. On that screen leave the top two check boxes unchecked (no need to allow remote connections). Enter a source port (3306 is fine if you don't have MySQL installed on your client machine). For the Destination enter "gcs-host:3306". "gcs-host" meaning the Google Cloud Services hostname. Then for the two radio button options below that, Local and Auto.
Save your connection info and connect.
Now you should be able to start MySQL workbench and use "localhost:3306" as the server name.
From the command line it would be something similar to:
ssh -L 3306:GCS-host:3306 proxy-host
This relies on you having SSH access to proxy-host and simply opens up a listening port on your local machine on 3306 so you can tell Navicat to attach to localhost:3306.
You may hit complications if you have a local MySQL server already running listening on 3306, in this case just choose a free port for the first number in the command and adjust your Navicat config.