Why can't I connect to a Google VM instance vi

Question

Using the Google Developer Console "Compute Engine" I am trying to connect to a Google VM instance via SSH. It doesn't work. I had trouble creating the instance to begin with due to a problem with the "network association". Here was my question and solution for that: Why is "Create" disabled in Google Compute Engine VM instances?

What are the likely causes for my SSH issue now?

Answer 1

It turned out to be a firewall issue. Unlike the "default" network, when you add one manually, it doesn't automatically open port 22 for ssh to work.

The easiest way to fix this is via the Google Developer Console "Networking" page. If you go to the networks section and select the custom network you are using, it has the option to add firewall rules. Unfortunately for me, I didn't figure this out until I did it with the Google Cloud Shell... Here's how I did it the "long way", which will in fact give you more control and insight into this whole Google VM management model. It will also ensure you can connect via the Google Cloud Shell in case you need to again in the future:

In the "Compute Engine" go to the VM section and select your VM. In the top left corner of the screen is an "SSH" button and an ellipsis ("...") button. Click the "..." and select "View gcloud command". When that window opens, copy the command to the clipboard. Then close the window and click the ">_" (Activate Google Cloud Shell) button in the upper right corner of the screen.

When the shell loads, paste in the command (with Ctrl+V). After attempting to connect, it will eventually time out if you have this firewall problem going on.

To display the firewall rules on the network you are using enter the following:

gcloud compute firewall-rules list

To inspect a rule in more detail use this:

gcloud compute firewall-rules describe [rule name]

Check for a rule with a suffix of "allow-ssh", or more specifically one that opens up port 22. It is probably missing.

If you were in fact on the "default" network, you could use the command you'll find in the Google documentation for this:

gcloud compute firewall-rules create default-allow-ssh --allow tcp:22

But, if you are on an alternate network, use this more explicit command:

gcloud compute firewall-rules create [network name]-allow-ssh --allow tcp:22 --network [network name] --source-ranges 0.0.0.0/0 --description "Allow SSH from anywhere." 

Replace [network name] with your literal value.

After executing that, try the connection command again. It ought to work now!