This document describes how to connect to a virtual machine (VM) instance
through its internal IP address, from an on-premises network that uses
[Cloud VPN](https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/overview) or
[Cloud Interconnect](https://docs.cloud.google.com/network-connectivity/docs/interconnect/concepts/overview)
to connect to the VM's Virtual Private Cloud (VPC) network.

Connecting to a VM by using its internal IP address is useful if the VM doesn't
have an external IP address. If the VM does have an external IP address,
[connect to the VM by using its external IP
address](https://docs.cloud.google.com/compute/docs/instances/connecting-to-instance).
If your on-premises network isn't connected to your VM's VPC
network and you need to connect to your VM's internal IP address, review the
other methods listed in [Choose a connection option for internal-only
VMs](https://docs.cloud.google.com/compute/docs/connect/ssh-internal-ip).

## Supported operating systems

Compute Engine supports these connection methods for all
[public Linux images](https://docs.cloud.google.com/compute/docs/images/os-details). For Fedora CoreOS images, you must
[set up SSH access](https://docs.fedoraproject.org/en-US/fedora-coreos/getting-started/)
before you can use these methods.

## Connect to VMs

To connect to a VM, complete the steps in one of the following tabs.

### gcloud

Connect to a VM by using SSH and by running the
[`gcloud compute ssh`
command](https://docs.cloud.google.com/sdk/gcloud/reference/compute/ssh) with the
[`--internal-ip` flag](https://docs.cloud.google.com/sdk/gcloud/reference/compute/ssh#--internal-ip):

1. In the Google Cloud console, activate Cloud Shell.

   [Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true)


   At the bottom of the Google Cloud console, a
   [Cloud Shell](https://docs.cloud.google.com/shell/docs/how-cloud-shell-works)
   session starts and displays a command-line prompt. Cloud Shell is a shell environment
   with the Google Cloud CLI
   already installed and with values already set for
   your current project. It can take a few seconds for the session to initialize.
2. Connect to the VM by running the following command:

   ```
   gcloud compute ssh INSTANCE_NAME \
       --project=PROJECT_ID \
       --zone=ZONE \
       --internal-ip
   ```

   Replace the following:
   - `INSTANCE_NAME`: the name of the VM that you want to connect to.
   - `PROJECT_ID`: the ID of the project that contains the VM.
   - `ZONE`: the name of the zone that the VM is located in.

> [!NOTE]
> **Note:** When you connect to VMs by using the gcloud CLI, Compute Engine creates a persistent SSH key for you. For more information about SSH keys, see [SSH connections to Linux
> VMs](https://docs.cloud.google.com/compute/docs/instances/ssh).

### IAP Desktop

To connect to a VM using IAP Desktop, do the following:

1.
   [Install IAP Desktop](https://github.com/GoogleCloudPlatform/iap-desktop/)
   on your workstation if you haven't already.

2.
   Open IAP Desktop. The **Add projects** window opens.

3.

   When prompted, sign in using the Google account that has access to the project with the VMs
   you want to connect to.

4.
   In the **Add projects** window, enter the project ID or name of the
   project that contains the VMs you want to connect to.

5.
   In the **Project Explorer** window, right-click the name of the VM that
   you want to connect to and select **Connection settings**.

6.
   In the **Connection settings** window, set **Connect via**
   to **Vpc**.

7.
   In the **Project Explorer** window, right-click the name of the VM
   again and select **Connect** to connect to the VM.

### OpenSSH client

To connect through a VM's internal IP address from an OpenSSH client, do the
following:

1. If you haven't already added an SSH key, [add an SSH key](https://docs.cloud.google.com/compute/docs/connect/add-ssh-keys) to the VM.
2. In the Google Cloud console, go to the **VM instances**
   page and find the

   internal IP address

   of the

   VM that you want to connect to.

   [Go to VM instances](https://console.cloud.google.com/compute/instances)
3. Open a terminal on your workstation.
4. Connect to the

   VM by running the following command:

   ```
   ssh -i PATH_TO_PRIVATE_KEY USERNAME@INTERNAL_IP
   ```

   Replace the following:
   - `PATH_TO_PRIVATE_KEY`: the path to the private SSH key file that corresponds to the public key that you added to the VM, such as `~/.ssh/my-ssh-key`, or `~/.ssh/google_compute_engine` if the Google Cloud CLI generated the key.
   - `USERNAME`: your username. If you manage your SSH keys in metadata, the username is what you specified when you [created the SSH
     key](https://docs.cloud.google.com/compute/docs/connect/create-ssh-keys). For OS Login accounts, the username is [defined in
     your Google profile](https://docs.cloud.google.com/compute/docs/connect/add-ssh-keys#os-login), such as `cloudysanfrancisco_example_com` or `cloudysanfrancisco`.
   - `INTERNAL_IP`: the internal IP address of the VM.

### PuTTY app

To connect through a VM's internal IP address by using PuTTY, do the
following:

1. If you haven't already added an SSH key, [add an SSH key](https://docs.cloud.google.com/compute/docs/connect/add-ssh-keys) to the VM.
2. If your workstation doesn't already have the PuTTY app installed, [download the PuTTY package files](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html).
3. In the Google Cloud console, go to the **VM instances**
   page and find the

   internal IP address of the VM that you want to connect to.

   [Go to VM instances](https://console.cloud.google.com/compute/instances)
4. Open the PuTTY app. A connection configuration window opens.
5. In the **Host Name (or IP address)** field, enter the
   username associated with the SSH key and the

   internal IP address of the VM that you want to connect to.

   Use the following format:

   ```
   USERNAME@INTERNAL_IP
   ```

   Replace the following:
   - `USERNAME`: your username. If you manage your SSH keys in metadata, the username is what you specified when you [created the SSH
     key](https://docs.cloud.google.com/compute/docs/connect/create-ssh-keys). For OS Login accounts, the username is [defined in
     your Google profile](https://docs.cloud.google.com/compute/docs/connect/add-ssh-keys#os-login), such as `cloudysanfrancisco_example_com` or `cloudysanfrancisco`.
   - `INTERNAL_IP`: the internal IP address of the VM.
6. In the **Category** menu, go to **Connection \> SSH \> Auth \>
   Credentials** (or **Connection \>
   SSH \> Auth** in PuTTY versions earlier than 0.78).
7. In the **Private key file for authentication** field, click **Browse** and select the private SSH key file (`.ppk`) that corresponds to the public key that you added to the VM.
8. Click **Open** to connect to the VM.

## Troubleshooting

To find methods for diagnosing and resolving failed SSH connections, see
[Troubleshooting SSH](https://docs.cloud.google.com/compute/docs/troubleshooting/troubleshooting-ssh).

## What's next

- Learn how to [manage access to VMs](https://docs.cloud.google.com/compute/docs/instances/access-overview).
- Learn how to [transfer files to VMs](https://docs.cloud.google.com/compute/docs/instances/transfer-files).
- Learn how [SSH connections to Linux VMs](https://docs.cloud.google.com/compute/docs/instances/ssh) work on Compute Engine.