3

We have an instance running in US-central-1 zone which started getting an error as follows:

Connection via Cloud Identity-Aware Proxy Failed Code: 4003 Reason: failed to connect to backend You may be able to connect without using the Cloud Identity-Aware Proxy.

I'm unable to connect without using the Cloud Identity-Aware Proxy either, where it shows the following message:

We are unable to connect to the VM on port 22.

The website running on this instance is a live ecommerce platform without another running backup instance. Please resolve this issue as soon as possible.

PS: We haven't made any changes to the VM after it was found working. And we are not touching any quota limits.

user594268
  • 31
  • 1
  • 1
  • 2

3 Answers3

4

If the allowed Ingress for tcp:22, included your source/s IP then there is no issue with the GCP firewall and my suggestion is to do the following steps and established a serial connection to your VM and after that will be able to check the SSH service is up and in the listening mode or even check for any firewall blocking inside your VM.

  1. Go to the VM instances page in Google Cloud Platform console.
  2. Click on the instance for which you want to add a startup script.
  3. Click the Edit button at the top of the page.
  4. Click on 'Enable connecting to serial ports'
  5. Under Custom metadata, click Add item.
  6. Set 'Key' to 'startup-script' and set 'Value' to this script:
#!/bin/bash
 
useradd -G sudo USERNAME
 
echo 'USERNAME:PASSWORD' | chpasswd

NOTE: Change the value of USERNAME & PASSWORD to the username and password of your choice.

  1. Click Save and then click RESET on the top of the page. You might need to wait for some time for the instance to reboot.
  2. Click on 'Connect to serial port' in the page.
  3. In the new window, you might need to wait a bit and press on Enter of your keyboard once; then, you should see the login prompt.
  4. Login using the USERNAME and PASSWORD you provided.
mannyglover
  • 103
  • 3
Ali Reza Izadi
  • 81
  • 2
0

Make sure that the VMs are tagged with the same target tag that you specified in your firewall rule. For example, the tag might be called something like allow-ssh.

Betsy Lichtenberg
  • 1
0

Google Cloud forum post on solution provided by @Ali Reza Izadi.

Refer here

Video Demo

Correct script:

#!/bin/bash
useradd USERNAME
echo USERNAME:PASSWORD | chpasswd
cesiya1944
  • 1
  • 2