I've been experimenting with GCP and have configured GCP's firewall rules to allow my company's public IP and my own dynamic IP to be able to SSH into the instances (on their respective static public IPs).

It's been working fine for a week or so.

Today, I've been unable to SSH into the instances via PuTTY, or even Google's own SSH web client.

I double-checked my public IPs (from which my SSH connections are originating from) and they are correct. I double-checked GCP's firewall rules and they are still in place to allow SSH to all instances from my remote public IPs. But it just denies the traffic.

I have found that if I alter the GCP firewall rule to allow 0.0.0.0/0 in over SSH, then it works(!). If I then view the /var/log/secure log, it reveals it looks like I am connecting from Google's own IP ranges (74.125.0.0/16)?!

[root@g000002 log]# tailf secure
Sep 14 12:24:14 g000002 sshd[12807]: Accepted publickey for MY_NAME from 74.125.73.34 port 63302 ssh2: ECDSA SHA256:J+afN3Gx/ndAch17Y2Yos21ENY1o7aHdzl8tgdCKGKc
Sep 14 12:24:14 g000002 sshd[12807]: pam_unix(sshd:session): session opened for user MY_NAME by (uid=0)

Does anyone have any experience with this? Am I misinterpreting the secure log? Does anyone know why GCP's firewall behaves this way - is there a fix or workaround?

Thank you.

sigh

After making some lunch and returning, the original rule is working again now. Unfortunately, GCP's firewall must be buggy/temperamental.

  • Before you noticed SSH is not working, did you make any changes to your Cloud settings (Firewalls or any other thing) ? Some changes may take time or make issues in connectivity. If that is not the case, the problem might be just transient. – mehdi sharifi Sep 16 at 1:10

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.