This document describes how to connect to a virtual machine (VM) instance
through its internal IP address, using
[Identity-Aware Proxy (IAP) TCP forwarding](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding).

IAP TCP forwarding lets you establish an encrypted tunnel
over which you can forward SSH connections to VMs. When you connect to a VM
that uses IAP, IAP wraps the SSH connection
inside HTTPS before forwarding the connection to the VM. Then,
IAP checks if you have the
[required IAM permissions](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding#grant-permission)
and if you do, grants access to the VM.

If you need to connect to a VM that doesn't have external IP addresses and you
can't use IAP, review the other methods listed in
[Connection options for internal-only VMs](https://docs.cloud.google.com/compute/docs/connect/ssh-internal-ip).

## Before you begin

- [Create a firewall rule](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding#create-firewall-rule) to enable connections from IAP.
- If you haven't already, set up [authentication](https://docs.cloud.google.com/compute/docs/authentication). Authentication verifies your identity for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

  Select the tab for how you plan to use the samples on this page:

  ### Console


  When you use the Google Cloud console to access Google Cloud services and
  APIs, you don't need to set up authentication.

  ### gcloud

  1.
     [Install](https://docs.cloud.google.com/sdk/docs/install) the Google Cloud CLI.

     After installation,
     [initialize](https://docs.cloud.google.com/sdk/docs/initializing) the Google Cloud CLI by running the following command:

     ```bash
     gcloud init
     ```


     If you're using an external identity provider (IdP), you must first
     [sign in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud).

     > [!NOTE]
     > **Note:** If you installed the gcloud CLI previously, make sure you have the latest version by running `gcloud components update`.

  2. [Set a default region and zone](https://docs.cloud.google.com/compute/docs/gcloud-compute#set_default_zone_and_region_in_your_local_client).

## Supported operating systems

These connection methods are supported for all
[public Linux images](https://docs.cloud.google.com/compute/docs/images/os-details) that are available on
Compute Engine. For Fedora CoreOS images, you must
[set up SSH access](https://docs.fedoraproject.org/en-US/fedora-coreos/tutorial-containers/)
before you can use these methods.

## Connect to VMs

To connect to a VM, complete the steps in one of the following tabs.

#### Permissions required for this task

To perform this task, you must have the following
[permissions](https://docs.cloud.google.com/iam/docs/overview#permissions):


- All permissions included in the [IAP roles](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding#grant-permission).

<br />

### Console

Tunnel SSH connections through a VM's internal IP address using
SSH-in-Browser by doing the following:

> [!NOTE]
> **Note:** SSH-in-Browser only uses IAP if the VM doesn't have an external IP address.


1. In the Google Cloud console, go to the **VM instances** page.

   [Go to VM instances](https://console.cloud.google.com/compute/instances)
2. In the list of virtual machine instances, click **SSH** in the row of the instance that you want to connect to.

<br />

> [!NOTE]
> **Note:** When you connect to VMs using the Google Cloud console, Compute Engine creates an ephemeral SSH key for you. For more information about SSH keys, see [SSH connections to Linux VMs](https://docs.cloud.google.com/compute/docs/instances/ssh).

### gcloud

Tunnel SSH connections through a VM's internal IP address by using the
[`gcloud compute ssh`
command](https://docs.cloud.google.com/sdk/gcloud/reference/compute/ssh) with the
[`--tunnel-through-iap` flag](https://docs.cloud.google.com/sdk/gcloud/reference/compute/ssh#--tunnel-through-iap):

1. In the Google Cloud console, activate Cloud Shell.
2. [Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true)
3. At the bottom of the Google Cloud console, a [Cloud Shell](https://docs.cloud.google.com/shell/docs/how-cloud-shell-works) session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
4. Connect to the VM by running the following command:

   ```
   gcloud compute ssh INSTANCE_NAME \
       --project=PROJECT_ID \
       --zone=ZONE \
       --tunnel-through-iap
   ```

   Replace the following:
   - `INSTANCE_NAME`: the name of the VM that you want to connect to.
   - `PROJECT_ID`: the ID of the project that contains the VM.
   - `ZONE`: the name of the zone that the VM is located in.

> [!NOTE]
> **Note:** When you connect to VMs by using the gcloud CLI, Compute Engine creates a persistent SSH key for you. For more information about SSH keys, see [SSH connections to Linux
> VMs](https://docs.cloud.google.com/compute/docs/instances/ssh).

### IAP Desktop

To connect to a VM using IAP Desktop, do the following:

1.
   [Install IAP Desktop](https://github.com/GoogleCloudPlatform/iap-desktop/)
   on your workstation if you haven't already.

2.
   Open IAP Desktop. The **Add projects** window opens.

3.

   When prompted, sign in using the Google account that has access to the project with the VMs
   you want to connect to.

4.
   In the **Add projects** window, enter the project ID or name of the
   project that contains the VMs you want to connect to.

5.
   In the **Project Explorer** window, right-click the name of the VM
   again and select **Connect** to connect to the VM.

### OpenSSH clients

Connect to a VM that doesn't have an external IP address by using SSH
through an IAP tunnel. You can write your own SSH
configuration file (`~/.ssh/config`) so that tools such as VS Code or
an OpenSSH client can connect directly.

1. Generate and propagate your SSH keys by connecting to your VM at least
   once by running the
   [`gcloud compute ssh` command](https://docs.cloud.google.com/sdk/gcloud/reference/compute/ssh):

   ```
   gcloud compute ssh INSTANCE_NAME \
       --project=PROJECT_ID \
       --zone=ZONE \
       --tunnel-through-iap
   ```

   Replace the following:
   - `INSTANCE_NAME`: the name of the VM that you want to connect to.
   - `PROJECT_ID`: the ID of the project that contains the VM.
   - `ZONE`: the zone where your VM is located.

   After the connection succeeds, exit the SSH session.
2. Open or create the SSH configuration file on your local workstation.
   This file is typically located at `~/.ssh/config` on Linux and
   macOS, or `%USERPROFILE%\.ssh\config` on Windows.

3. Append a configuration entry for your VM by adding the following block
   to your SSH configuration file:

   ```
   Host INSTANCE_NAME
       HostName INSTANCE_NAME
       IdentityFile PATH_TO_PRIVATE_KEY
       ProxyCommand gcloud compute start-iap-tunnel %h %p --listen-on-stdin --project=PROJECT_ID --zone=ZONE --verbosity=warning
       User USERNAME
   ```

   Replace the following:
   - `INSTANCE_NAME`: the name of the VM that you want to connect to.
   - `PATH_TO_PRIVATE_KEY`: the path to your private key file, typically `~/.ssh/google_compute_engine`.
   - `PROJECT_ID`: the ID of the project that contains the VM.
   - `ZONE`: the zone where your VM is located.
   - `USERNAME`: the username on the VM, such as your Google Cloud OS Login username or the metadata username.
4. Connect to the VM from your local terminal or SSH client by running
   the following command:

   ```
   ssh INSTANCE_NAME
   ```

### PuTTY app

To tunnel SSH connections through a VM's internal IP address by using PuTTY,
do the following:

1. If you haven't already added an SSH key, [add an SSH key](https://docs.cloud.google.com/compute/docs/connect/add-ssh-keys) to the VM.
2. If your workstation doesn't already have the PuTTY app installed, [download the PuTTY package files](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html).
3. In the Google Cloud console, go to the **VM instances**
   page and find the

   name of the VM that you want to connect to.

   [Go to VM instances](https://console.cloud.google.com/compute/instances)
4. Open the PuTTY app. A connection configuration window opens.
5. In the **Host Name (or IP address)** field, enter the
   username associated with the SSH key and the

   name of the VM that you want to connect to.

   Use the following format:

   ```
   USERNAME@INSTANCE_NAME
   ```

   Replace the following:
   - `USERNAME`: your username. If you manage your SSH keys in metadata, the username is what you specified when you [created the SSH
     key](https://docs.cloud.google.com/compute/docs/connect/create-ssh-keys). For OS Login accounts, the username is [defined in
     your Google profile](https://docs.cloud.google.com/compute/docs/connect/add-ssh-keys#os-login), such as `cloudysanfrancisco_example_com` or `cloudysanfrancisco`.
   - `INSTANCE_NAME`: the name of the VM.
6. In the **Category** menu, go to **Connection \> SSH \> Auth \>
   Credentials** (or **Connection \>
   SSH \> Auth** in PuTTY versions earlier than 0.78).
7. In the **Private key file for authentication** field, click **Browse** and select the private SSH key file (`.ppk`) that corresponds to the public key that you added to the VM.
8. In the **Category** menu, go to **Connection \> Proxy**.
9. In the **Proxy type** section, select **Local**.
10. In the **Telnet command, or local proxy command** field,
    enter the following command:

    ```
    gcloud.cmd compute start-iap-tunnel INSTANCE_NAME PORT_NUMBER --listen-on-stdin --project=PROJECT_ID --zone=ZONE
    ```

    Replace the following:
    - `INSTANCE_NAME`: the name of the VM that you want to connect to.
    - `PORT_NUMBER`: the port that the `sshd` daemon runs on. The default `PORT_NUMBER` is `22`.
    - `PROJECT_ID`: the project that hosts the VM that you want to connect to.
    - `ZONE`: the zone where the VM is located.
11. Click **Open** to connect to the VM.

## Troubleshooting

To find methods for diagnosing and resolving failed SSH connections, see
[Troubleshooting SSH](https://docs.cloud.google.com/compute/docs/troubleshooting/troubleshooting-ssh).

## What's next

- Learn how to [manage access to VMs](https://docs.cloud.google.com/compute/docs/instances/access-overview).
- Learn how to [transfer files to VMs](https://docs.cloud.google.com/compute/docs/instances/transfer-files).
- Learn how [SSH connections to Linux VMs](https://docs.cloud.google.com/compute/docs/instances/ssh) work on Compute Engine.