Connect to Linux VMs using a bastion host

Linux

This document describes how to connect to a virtual machine (VM) instancethrough its internal IP address, using abastion host VM. Bastion hosts providean external point of entry into a Virtual Private Cloud (VPC) network thatcontains VMs that don't have external IP addresses. When using a bastion host,connect to the bastion host first, and then connect to the target VM.

Connecting to a VM using its internal IP address is useful if the VM doesn'thave an external IP address. If the VM does have an external IP address,connect to the VM using its external IP address.If you need to connect to a VM that doesn't have external IP addresses and youcan't use a bastion host, review the other methods listed inConnection options for internal-only VMs.

Supported operating systems

These connection methods are supported for allpublic Linux images that are available onCompute Engine. For Fedora CoreOS images, you mustset up SSH access before you can use these methods.

Create a bastion host VM

Create a Compute Engine VM within the private cluster internal networkto act as a bastion host that can manage the cluster.

Console

Create a bastion host VM by doing the following:

  1. In the Google Cloud console, go to theCreate an instance page.

    Go to Create an instance

    1. Specify the following VM details:
    • Name: the name of your VM.
    • Machine type: a machine type. Choose a small machine type, suchase2-micro.
    • Boot disk Operating system: any Linux OS.

  2. Expand theAdvanced options section, and do the following:

    1. In theNetwork interfaces section, select the sameVPC network and subnet as the target VM.

    2. ForExternal IPv4 address, selectEphemeral.

  3. To create and start the VM, clickCreate.

gcloud

Create a bastion host VM using thegcloud compute instances create command:

  1. In the Google Cloud console, activate Cloud Shell.

    Activate Cloud Shell

    At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  2. Create the bastion host VM by running the following command:

    gcloud compute instances createVM_NAME \  --zone=ZONE \  --machine-type=e2-micro \  --image-family=IMAGE_FAMILY \  --image-project=IMAGE_PROJECT \  --network-interface=subnet=SUBNET,address=""

    Replace the following:

    • VM_NAME: the name of the VM.
    • ZONE: the zone for VM.
    • IMAGE_FAMILY: a Linuximage family.
    • IMAGE_PROJECT: theimage projectcontaining the image.
    • SUBNET: the same VPC subnet asthe target VM. If you use the default VPC, theSUBNET isdefault.

Connect to VMs

To connect to a VM, complete the steps in one of the following tabs.

gcloud

Permissions required for this task

To perform this task, you must have the followingpermissions:

You must additionallyassign your service account to a VM and set thecloud-platform access scopeon the VM.

Connect to a VM using SSH through a bastion host by running thegcloud compute ssh command:

  1. Connect to the bastion host VM by running the following command:

    gcloud compute sshBASTION_NAME

    ReplaceBASTION_NAME with the name of the bastion host VM.

  2. From the bastion host VM, connect to the main VM through it's internal IP address by using the--internal-ip flag:

    gcloud compute sshVM_NAME \    --internal-ip

    ReplaceVM_NAME with the name of the VM that you want to connect to.

Note: When you connect to VMs using the gcloud CLI, Compute Engine creates a persistent SSH key for you. For more information about SSH keys, seeSSH connections to Linux VMs.

OpenSSH clients

Connect to a VM through a bastion host from an OpenSSH client, by doing the following:

  1. Add an SSH key to the VM if you haven't already.

  2. In the Google Cloud console, go to theVM Instances page and find the external IP address of the bastion host VM.

    Go to VM Instances

  3. Open a terminal on your workstation.

  4. Connect to the bastion host VM by running the following command:

    ssh -A -iPATH_TO_PRIVATE_KEYUSERNAME@EXTERNAL_IP

    Replace the following:

    • PATH_TO_PRIVATE_KEY: the path to the private SSH key file that corresponds to the public key you added to the VM.
    • USERNAME: your username. If you manage your SSH keys in metadata, the username is what you specified when youcreated the SSH key. For OS Login accounts, the username isdefined in your Google profile. For example,cloudysanfrancisco_example_com orcloudysanfrancisco.
    • EXTERNAL_IP: the external IP address of the VM.

  5. From the bastion host VM, connect through a VM's internal IP address using the following command:

    sshUSERNAME@INTERNAL_IP

    Replace the following:

    • USERNAME: your username. If you manage your SSH keys in metadata, the username is what you specified when youcreated the SSH key. For OS Login accounts, the username isdefined in your Google profile. For example,cloudysanfrancisco_example_com orcloudysanfrancisco.
    • INTERNAL_IP: the internal IP address of the VM.

PuTTY app

Connect to a VM through a bastion host using PuTTY, by doing the following:

  1. Add an SSH key to the bastion host VM if you haven't already.
  2. If your workstation doesn't already have the PuTTY app installed,download the PuTTY package files.

  3. In the Google Cloud console, go to theVM Instances page and find the internal IP address of the VM that you want to connect to.

    Go to VM Instances

  4. Open the PuTTY app. A connection configuration window opens.

  5. In theHost Name field, enter the username associated with the SSH key, and the external IP address of the VM that you want to connect to. Use the following format:

    USERNAME@EXTERNAL_IP

    Replace the following:

    • USERNAME: your username. If you manage your SSH keys in metadata, the username is what you specified when youcreated the SSH key. For OS Login accounts, the username isdefined in your Google profile. For example,cloudysanfrancisco_example_com orcloudysanfrancisco.
    • EXTERNAL_IP: the external IP address of the VM.
  6. In theCategory menu, navigate toConnection > SSH > Auth.
  7. In thePrivate key file for authentication field, select the private SSH key file that corresponds to the public key you added to the VM.
  8. In theAuthentication Parameters section, selectAllow agent forwarding.
  9. ClickOpen to connect to the bastion host VM.

  10. From the bastion host VM, connect through a VM's internal IP address using the following command:

    sshUSERNAME@INTERNAL_IP

    Replace the following:

    • USERNAME: your username. If you manage your SSH keys in metadata, the username is what you specified when youcreated the SSH key. For OS Login accounts, the username isdefined in your Google profile. For example,cloudysanfrancisco_example_com orcloudysanfrancisco.
    • INTERNAL_IP: the internal IP address of the VM.

Troubleshooting

To find methods for diagnosing and resolving failed SSH connections, seeTroubleshooting SSH.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.