GCP PlayCloud Labs Guided Lab: Setting Up a Linux Bastion Host on GCP

In Progress

Lesson 19 of 41

In Progress

Guided Lab: Setting Up a Linux Bastion Host on GCP

Jon-Bonso

Description

Bastion hosts provide an external point of entry into a Virtual Private Cloud (VPC) network that contains VMs that don’t have external IP addresses. When using a bastion host, connect to the bastion host first, and then connect to the target VM.

This lab demonstrates how to securely access private instances in Google Cloud using a bastion host. You’ll create a VPC with public and private subnets, configure firewall rules, deploy a bastion host VM, and connect to an internal VM by managing SSH keys.

Prerequisites

To ensure the successful completion of this lab, we highly recommend taking the following guided labs to gain the necessary understanding:

Objectives

In this lab, you will:

Deploy a Linux bastion host in a public subnet.
Create a custom VPC Network.
Configure firewall rules during VPC creation.
Connect to the bastion host via the GCP Console.
Generate and secure an SSH key pair (private + public key).
Add the bastion’s public key to the internal VM for SSH access.
Verify secure connectivity to the internal VM.

Subscribe to access GCP PlayCloud Labs

Lab Steps

Create a VPC Network (with Firewall Rules)

1. Navigate to VPC Network > VPC networks.

2. Click Create VPC network.

3. Name: bastion-vpc.

4. Add two subnets:

public-subnet → 10.0.1.0/24 (for bastion host)

private-subnet → 10.0.2.0/24 (for internal VMs)

5. While creating the VPC, configure firewall rules:

Check the bastion-vpc-allow-ssh

6. Click the Create button.

Deploy the Bastion Host VM

1. Go to Compute Engine > VM instances.

2. Click Create instance.

3. Name: bastion-host.

4. Machine type: e2-micro.

5. Boot disk: Ubuntu.

6. Network: attach to public-subnet.

7. Ensure it has an external IP.

8. Create the VM

Deploy the Internal VM

1. Create another VM named internal-vm.

2. Machine type: e2-micro.

3. Boot disk: Ubuntu.

4. Attach it to private-subnet.

5. Ensure no external IP is assigned.

6. Create the VM.

Connect to Bastion Host

1. In the GCP Console, go to VM instances.

2. Activate the CloudShell by clicking the CLI icon at the top.

3. Enter the password when prompted.

Configure SSH Key Access

1. In the Cloud Shell, SSH to the bastion-host VM using this command:

gcloud compute ssh bastion-host --zone us-central1-c

2. Inside the bastion host, generate a new key pair. You can choose any filename (example: my-gcp-key)

ssh-keygen -t rsa -b 4096 -f ~/my-gcp-key

3. Optionally, enter passphrase (empty for no passphrase)

4. This creates:

my-gcp-key.pub → public key file
my-gcp-key → private key file

5. Copy the public key content (starting with ssh-rsa but excluding the td_gcp_labs_student portion).

3. In the GCP Console, edit the internal-vm → SSH Keys → paste the bastion host’s public key.

When pasting the public key, ensure it ends with the username you intend to log in with. For example: ssh-rsa AAAAB3… ubuntu

4. Click the Save button.

Connect to Internal VM from Bastion

1. From the bastion host shell, connect to the internal VM using its private IP:

ssh -i ~/.ssh/google_compute_engine <username>@10.0.2.2

Replace <username> with the Linux account name (e.g., ubuntu or the one provisioned by gcloud). It should be the same as what you added in the internal-vm SSH key.

2. You should now see a shell prompt on the internal VM.

Verify Connectivity

1. Run simple commands on the internal VM:

whoami hostname uptime

2. Confirm that access is only possible through the bastion host.

Congratulations! You have successfully set up a bastion host in Google Cloud and used it to securely access a private VM. This pattern ensures that internal resources remain isolated from the public internet while still being accessible for administrative tasks through a controlled gateway.