Unable to SSH into GCE VM from outside of Google Cloud network

Question

I'm able to access a newly provisioned Google Computer instance running Ubuntu 16 via Google Cloud Web SSH interface, and also from other Google compute instances (even ones from different projects)

But when I try to ssh into the instance from my home computer, it gives a "Connection timed out"

I already checked UFW, it's set to allow 22/tcp.

The default ssh firewall ingress rule is also set : default-allow-ssh Ingress Apply to all
IP ranges: 0.0.0.0/0 tcp:22 Allow

Not sure what the issue here is. My home network can access other GCE instances via SSH, and this particular GCE instance's web server is also accessible.

It seems specifically SSH connections from my home network is being blocked.

Answer 1

Which IP are you using?

You must use your instance external IP if you want to SSH from outside GCP. See GCP official documentation on how to connect to your instances (advanced methods).

Once you are able to reach your instance you might want to configure OS Login to make things easier for you.

“OS Login allows you to use Compute Engine IAM roles to manage SSH access to Linux instances and is an alternative to manually managing instance access by adding and removing SSH keys in metadata.”

See link [2] to configure OS Login

If the above recommendations do not work, please provide the output of the command ssh with -vvv to understand what is happening.

[1] https://cloud.google.com/compute/docs/instances/connecting-advanced#thirdpartytools

[2] https://cloud.google.com/compute/docs/instances/managing-instance-access

Answer 2

Post was too long for a comment ...

I hoped the command gave us more clues :( . Without looking into your project FW rules and VM network tags is going to be difficult to narrow it down.

As you already mentioned that you have the proper firewall rules I can only think that you haven’t uploaded your SSH keys (from your home computer) into the instance

You can find clear instructions from Google documentation on how to generate these keys and uploaded in link [1]

Once you have done that the correct command to ssh is:

ssh -i [PATH_TO_PRIVATE_KEY] [USERNAME]@[EXTERNAL_IP_ADDRESS]

where:

• [PATH_TO_PRIVATE_KEY] is the path to your private SSH key file.
• [USERNAME] is the name of the user connecting to the instance. The username for your public SSH key was specified when the SSH key was created. You can connect to the instance as that user if the instance has a valid public SSH key for that user and if you have the matching private SSH key.
• [EXTERNAL_IP_ADDRESS] is the external IP address for your instance.

If that doesn't work you should try to contact GCP support, there might be certain things you don't see for example your project might be part of an organization and under a VPC perimeter that prevents the access from external networks [1]

[1] https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys

[2] https://cloud.google.com/vpc-service-controls/