Search code examples
google-cloud-platformsshgoogle-cloud-compute-enginegoogle-cloud-identity-aware-proxy

Cannot connect to GCP Compute Engine Instance - Error while connecting [4003: 'failed to connect to backend']. (Failed to connect to port 22)

I'm facing a new issue where I'm unable to connect to my GCP Compute Engine instance for the past 2 days. I'd set up the VM, and the firewall rules including enabling IAP for TCP Tunneling about a week ago, and was able to SSH to my machine using this command fine up until 2 days ago.

gcloud compute ssh <vm-name> --zone=us-west1-b --quiet --tunnel-through-iap --project=<project-name>

Running the above command in my terminal issues this error:

ERROR: (gcloud.compute.start-iap-tunnel) Error while connecting [4003: 'failed to connect to backend']. (Failed to connect to port 22)

kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

Here is the firewall rule I set up to enable the IAP TCP tunneling access

enter image description here

I can see that my VM instance is included in the "Applicable to instances" list.

I was also unable to connect via SSH to the instance using the in-built SSH tool. Here's a screenshot of the error:

enter image description here

According to this error, it seems that the access to VM is blocked by a firewall and I've made sure to set up the firewall correctly.

I've tried solutions outlined in these posts:

  • Post 1
  • This answer in the Google Cloud Community.

But I'm still unable to connect to my VM. I've also deleted and re-created the firewall rules a couple of times now to no avail.

What might be causing this? I'm new to GCP and networking concepts so if there's something I'm missing, please point me to the resources.

Appreciate your help, thanks a lot!

Solution

  • After multiple days (attempts) trying to figure out the cause of this issue, I looked through the logs of my VM, and found the error mentioned in this link

    I decided to tear down the Compute Engine instance and the firewall rules I'd set, and created a new Compute Engine instance and re-created the firewall rules.

    After doing this, I'm able to connect to the new VM without trouble.