Connecting to instances

This page describes some of the most common ways to connect to your Compute Engine Linux instances and Compute Engine Windows instances.

For additional ways to connect to your instances, see the following:

• Connecting using third-party tools, including PuTTY.
• Connecting to instances that have no external IP addresses

Before you connect, you must set up user access to your instance. This page assumes you've followed the Quickstart using a Linux VM guide or the Quickstart using a Windows VM guide to create your instance, which includes creating default user access.

Complete at least one of those guides before continuing.

To learn more about managing user access to your instance, see Managing Instance Access.

Connecting to Linux instances

To connect to Linux instances through the Google Cloud Platform Console or the gcloud command-line in the SDK, follow the steps in the tabs below:

If these basic SSH options do not work for you, you might need to connect to instances using third-party tools or connect to instances that have no external IP addresses.

Console

1. In the GCP Console, go to the VM Instances page.

   Go to the VM Instances page

2. In the list of virtual machine instances, click SSH in the row of the instance that you want to connect to.

   

gcloud

Use the gcloud compute ssh command to connect to instances that you have permission to access.

gcloud compute ssh --project [PROJECT_ID] --zone [ZONE] [INSTANCE_NAME]

Where:

• [PROJECT_ID] is the ID of the project that contains the instance.
• [ZONE] is the name of the zone in which the instance is located.
• [INSTANCE_NAME] is the name of the instance.

If you have set default properties for the gcloud command line tool, you can omit the --project and --zone flags from this command. For example:

gcloud compute ssh [INSTANCE_NAME]

After you connect, use the terminal to run commands on your Linux instance. When you are done, use the exit command to disconnect from the instance.

Where SSH keys are located

After you connect for the first time, Compute Engine generates an SSH keypair for you and stores it in one of the following locations:

• By default, Compute Engine adds the generated key to project or instance metadata.
• If your account is configured to use OS Login, Compute Engine stores the generated key with your user account.

It is not necessary to know where your SSH keys are stored if you're connecting in the ways described in this document, but you might need this if want to connect using the alternative or advanced methods of connecting described in Connecting to Instances Using Advanced Methods.

Connecting to Windows instances

To connect to Windows instances using RDP (Remote Desktop Protocol) in the Google Cloud Platform Console, or through a graphical interface, follow the steps in the tabs below:

Connect using a graphical RDP client

Before you connect, make sure you have created a Windows instance password and have it ready to enter in the following steps:

Console

To connect using the GCP Console with the Chrome RDP extension, do the following:

1. install the Chrome RDP for Google Cloud Platform extension.

2. Go to the VM instances page in GCP Console and find the Windows instance you want to connect to.

   Go to the VM instances page

3. Click the RDP button for the instance you want to connect to. The Chrome RDP extension opens.

4. Enter the domain, your username, and password, then click OK to connect.

   

   If your instance does not have a domain configured, you may leave the Domain field blank.

5. If prompted, press Continue to accept the certificate.

Remote Desktop

To connect with Microsoft Windows Remote Desktop, do the following:

1. Identify the external IP address of your Windows instance from the VM instances page.

   Go to the VM instances page

   Alternatively, find the external IP address by running the gcloud instances list command in the gcloud command line tool:

   gcloud compute instances list
   

2. Open Microsoft Windows Remote Desktop Connection on your Windows machine.

   

   Note: The executable can be located at %systemroot%/system32/mstsc.exe

3. Enter the external IP address into the Computer field. Click Connect.

   Note: If you've configured your instance to use a different port number for RDP, add it after the IP address. For example: 1.2.3.4:3389.

4. Enter your username and password. Then click OK to connect.

Other

To connect using clients on other platforms that support RDP, such as clients developed for Android, iOS, Mac, and others, do the following:

1. Identify the external IP address of your Windows instance from the VM instances page.

   Go to the VM instances page

   Alternatively, find the external IP address by running the gcloud instances list command in the gcloud command line tool:

   gcloud compute instances list
   

2. Install the supported client according to the client's installation instructions.

3. Connect using the external IP address of your instance, and authenticate with your username and password for the instance.

For a list of officially supported clients, see Microsoft's Remote Desktop Clients article.

If you have difficulties connecting using RDP, see the Troubleshooting RDP page.

Connect to a Windows instance using the command line

This section describes how to connect to your Windows instance using an interactive serial console, or the Windows Special Administrative Console (SAC), which is often used for advanced troubleshooting on Windows instances.

For more on using the interactive serial console, see Interacting with the serial console.

To connect to your Windows instance using an interactive serial console, follow the steps in the tabs below:

Console

To connect to your Windows instance using an interactive serial console through the GCP Console, do the following:

1. Open the VM instances page in GCP Console and click on the name of your instance. The VM instance details page opens.

   Go to the VM instances page

2. Click Edit. Under *Remote access, select Enable connecting to serial ports. This enables the interactive serial console for this instance.

   

   Alternatively, if you want these settings to apply to all instances in your project, set project-wide custom metadata instead.

   Caution: The interactive serial console does not support IP-based access restrictions such as IP based allow-lists or block-lists. If you enable the interactive serial console on an instance, anyone from any IP address will be able to connect if they know the SSH key, username, project ID, zone, and instance name.

   For more on updating instance metadata, see Storing and retrieving instance metadata

3. Click Save, then return to the top of the page.

4. Under Remote access, click the dropdown next to Connect to serial console, and select Serial port 2. A Windows Special Administrative Console (SAC) opens.

5. At the SAC> prompt, run cmd to create a new channel. SAC returns the channel name, such as Cmd001.

6. Run ch -sn [CHANNEL_NAME] and press any key to connect to the channel. For example:

   SAC> cmd
   The Command Prompt session was successfully launched.
   SAC>
   EVENT:   A new channel has been created.  Use "ch -?" for channel help.
   Channel: Cmd0001
   SAC> ch -sn cmd0001
   Press any key to confirm connection to the channel.
   

7. Enter the username, domain, and password of the instance to connect.

   Note: If the instance does not have a domain configured, don't input anything at the domain prompt; just press enter to continue.

gcloud

To connect to your Windows instance using an interactive serial console through the gcloud command line tool, do the following:

1. If you haven't done so already, download and install the Google Cloud SDK for your local operating system. See Installing Google Cloud SDK.

2. Launch Google Cloud SDK.

3. Run the following command to configure your instance to allow for connecting to serial ports.

   gcloud compute instances add-metadata [INSTANCE_NAME]
   --metadata=serial-port-enable=1
   

   Optional: If you want the settings to apply to all instances in your project, run the following gcloud SDK command instead:

   gcloud compute project-info add-metadata
   --metadata=serial-port-enable=1
   

   For more on project-wide custom metadata, see Setting project-wide custom metadata

   Caution: The interactive serial console does not support IP-based access restrictions such as IP based allow-lists or block-lists. If you enable the interactive serial console on an instance, anyone from any IP address will be able to connect if they know the SSH key, username, project ID, zone, and instance name.
   Note: You can also configure your instance's metadata by clicking the Edit button for your instance on the VM instance page.

   For more on updating metadata, see Updating instance metadata

4. Run the following gcloud command to enter an interactive session:

   gcloud compute connect-to-serial-port [INSTANCE_NAME] --port=2
   

   

5. At the SAC> prompt, run cmd to create a new channel. SAC returns the channel name, such as Cmd001.

6. Run ch -sn [CHANNEL_NAME] and press any key to connect to the channel. For example:

   SAC> cmd
   The Command Prompt session was successfully launched.
   SAC>
   EVENT:   A new channel has been created.  Use "ch -?" for channel help.
   Channel: Cmd0001
   SAC> ch -sn cmd0001
   Press any key to confirm connection to the channel.
   

7. Enter the username, domain, and password of the instance to connect.

   Note: If the instance does not have a domain configured, don't input anything at the domain prompt; just press enter to continue.

What's next

• Learn how to manage access to instances using OS Login for multiple users across a project or organization.
• Learn how to connect to instances using third-party tools.
• Learn how to connect to instances that have no external IP addresses.
• Learn how to connect to Windows instances using PowerShell
• Learn how to manage instance access manually by adding and removing SSH keys in metadata, which is an alternative to granting access through OS Login and IAM roles.
• Learn how to transfer files to instances.