gcloud compute start-iap-tunnel db 1433 --local-host-port=localhost:25452 --project=db

I can connect to a windows vm running the sql server image with the cli command above in a database client.

In the app, creating a tunnel to sql server must do something different because I cannot connect.

What is the difference between the above command and the app's command and what might I need to do differently to make the app's tunnel work?