Console
    Contact Us Start free

    Connect to Linux VMs using a bastion host

    This document describes how to connect to a virtual machine (VM) instance through its internal IP address, using a bastion host VM . Bastion hosts provide an external point of entry into a Virtual Private Cloud (VPC) network that contains VMs that don't have external IP addresses. When using a bastion host, connect to the bastion host first, and then connect to the target VM.

    Connecting to a VM using its internal IP address is useful if the VM doesn't have an external IP address. If the VM does have an external IP address, connect to the VM using its external IP address . If you need to connect to a VM that doesn't have external IP addresses and you can't use a bastion host, review the other methods listed in Connection options for internal-only VMs .

    Supported operating systems

    These connection methods are supported for all public Linux images that are available on Compute Engine. For Fedora CoreOS images, you must set up SSH access before you can use these methods.

    Create a bastion host VM

    Create a Compute Engine VM within the private cluster internal network to act as a bastion host that can manage the cluster.

    Console

    Create a bastion host VM by doing the following:

    1. In the Google Cloud console, go to the Create an instancepage.

      Go to Create an instance

      1. Specify the following VM details:
      • Name: the name of your VM.
      • Machine type: a machine type. Choose a small machine type, such as e2-micro .
      • Boot disk Operating system: any Linux OS.

    2. Expand the Advanced optionssection, and do the following:

      1. In the Network interfacessection, select the same VPC network and subnet as the target VM.

      2. For External IPv4 address, select Ephemeral.

    3. To create and start the VM, click Create.

    gcloud

    Create a bastion host VM using the gcloud compute instances create command :

    1. In the Google Cloud console, activate Cloud Shell.

      Activate Cloud Shell

      At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

    2. Create the bastion host VM by running the following command:

      gcloud compute instances create VM_NAME 
\
  --zone= ZONE 
\
  --machine-type=e2-micro \
  --image-family= IMAGE_FAMILY \
  --image-project= IMAGE_PROJECT 
\
  --network-interface=subnet=SUBNET,address=""

      Replace the following:

      • VM_NAME : the name of the VM.
      • ZONE : the zone for VM.
      • IMAGE_FAMILY : a Linux image family .
      • IMAGE_PROJECT : the image project containing the image.
      • SUBNET : the same VPC subnet as the target VM. If you use the default VPC, the SUBNET is default .

    Connect to VMs

    To connect to a VM, complete the steps in one of the following tabs.

    gcloud

    Permissions required for this task

    To perform this task, you must have the following permissions :

    You must additionally assign your service account to a VM and set the cloud-platform access scope on the VM.

    Connect to a VM using SSH through a bastion host by running the gcloud compute ssh command :

    1. Connect to the bastion host VM by running the following command:

      gcloud compute ssh BASTION_NAME

      Replace BASTION_NAME with the name of the bastion host VM.

    2. From the bastion host VM, connect to the main VM through it's internal IP address by using the --internal-ip flag :

      gcloud compute ssh VM_NAME 
\
    --internal-ip

      Replace VM_NAME with the name of the VM that you want to connect to.

    OpenSSH clients

    Connect to a VM through a bastion host from an OpenSSH client, by doing the following:

    1. Add an SSH key to the VM if you haven't already.

    2. In the Google Cloud console, go to the VM Instancespage and find the external IP address of the bastion host VM.

      Go to VM Instances

    3. Open a terminal on your workstation.

    4. Connect to the bastion host VM by running the following command:

      ssh -A -i PATH_TO_PRIVATE_KEY 
 USERNAME 
@ EXTERNAL_IP

      Replace the following:

      • PATH_TO_PRIVATE_KEY : the path to the private SSH key file that corresponds to the public key you added to the VM.
      • USERNAME : your username. If you manage your SSH keys in metadata, the username is what you specified when you created the SSH key . For OS Login accounts, the username is defined in your Google profile . For example, cloudysanfrancisco_example_com or cloudysanfrancisco .
      • EXTERNAL_IP : the external IP address of the VM.

    5. From the bastion host VM, connect through a VM's internal IP address using the following command:

      ssh USERNAME 
@ INTERNAL_IP

      Replace the following:

      • USERNAME : your username. If you manage your SSH keys in metadata, the username is what you specified when you created the SSH key . For OS Login accounts, the username is defined in your Google profile . For example, cloudysanfrancisco_example_com or cloudysanfrancisco .
      • INTERNAL_IP : the internal IP address of the VM.

    PuTTY app

    Connect to a VM through a bastion host using PuTTY, by doing the following:

    1. Add an SSH key to the bastion host VM if you haven't already.
    2. If your workstation doesn't already have the PuTTY app installed, download the PuTTY package files .

    3. In the Google Cloud console, go to the VM Instancespage and find the internal IP address of the VM that you want to connect to.

      Go to VM Instances

    4. Open the PuTTY app. A connection configuration window opens.

    5. In the Host Name field, enter the username associated with the SSH key, and the external IP address of the VM that you want to connect to. Use the following format:

       USERNAME 
@ EXTERNAL_IP

      Replace the following:

      • USERNAME : your username. If you manage your SSH keys in metadata, the username is what you specified when you created the SSH key . For OS Login accounts, the username is defined in your Google profile . For example, cloudysanfrancisco_example_com or cloudysanfrancisco .
      • EXTERNAL_IP : the external IP address of the VM.
    6. In the Categorymenu, navigate to Connection  > SSH  > Auth.
    7. In the Private key file for authenticationfield, select the private SSH key file that corresponds to the public key you added to the VM.
    8. In the Authentication Parameterssection, select Allow agent forwarding.
    9. Click Opento connect to the bastion host VM.

    10. From the bastion host VM, connect through a VM's internal IP address using the following command:

      ssh USERNAME 
@ INTERNAL_IP

      Replace the following:

      • USERNAME : your username. If you manage your SSH keys in metadata, the username is what you specified when you created the SSH key . For OS Login accounts, the username is defined in your Google profile . For example, cloudysanfrancisco_example_com or cloudysanfrancisco .
      • INTERNAL_IP : the internal IP address of the VM.

    Troubleshooting

    To find methods for diagnosing and resolving failed SSH connections, see Troubleshooting SSH .

    What's next

    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: