{"slug":"access-google-compute-engine-vms-privately-using-tailscale","title":"Access Google Compute Engine VMs privately using Tailscale","tags":["tailscale","access-control","setup"],"agent_summary":"Last validated: Dec 4, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Access Google Compute Engine VMs privately using Tailscale\r\n\r\nLast validated: Dec 4, 2025\r\n\r\nGoogle Cloud provides Linux virtual machines and you can use Tailscale to provide secure connectivity.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/install/cloud/gce\\#prerequisites)\r\n\r\nBefore you begin this guide, you'll need a Tailscale network (known as a tailnet) set up and configured with at least one existing device. Read our [getting started guide](https://tailscale.com/docs/how-to/quickstart) if you need help with this.\r\n\r\n## [Step 1: Set up the Tailscale client for the VM](https://tailscale.com/docs/install/cloud/gce\\#step-1-set-up-the-tailscale-client-for-the-vm)\r\n\r\nFirst, [create a Virtual Machine in the GCE Console](https://cloud.google.com/compute/docs/instances/create-start-instance).\r\n\r\nWhen creating the instance select **Management, security, disks, networking, sole tenancy**, select **Networking**, and select the **Network Interface**. Because we're later going to enable subnet routing on this VM, we want to set **IP forwarding** to **On**.\r\n\r\n![The Network Interface configurations featuring the IP forwarding setting.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgce-ip-forwarding.1b910e77.png&w=1920&q=75)\r\n\r\nOnce you create the VM, SSH to the system and follow the steps to [install Tailscale on Linux](https://tailscale.com/docs/install/linux).\r\n\r\n## [Step 2: Allow UDP port 41641](https://tailscale.com/docs/install/cloud/gce\\#step-2-allow-udp-port-41641)\r\n\r\nIf at least one side of a tunnel has \"easy NAT,\" where Tailscale can determine the UDP port number on the far side of the NAT device, then it will make [direct connections to minimize latency.](https://tailscale.com/blog/how-tailscale-works). We ensure that GCE nodes can make direct connections by allowing UDP port `41641` to ingress through the firewall.\r\n\r\nIn **VPC Network** \\> **Firewall** we add two rules:\r\n\r\n1. An ingress rule to allow `0.0.0.0/0` for UDP port `41641` to all instances.\r\n2. An ingress rule to allow `::/0` for UDP port `41641` to all instances.\r\n\r\n![The firewall rule for an example project featuring Direction of traffic set to Ingress and Protocols and ports set to 41641.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgce-firewall-rule.d7563267.png&w=750&q=75)\r\n\r\n## [Step 3: Advertise routes from the VM](https://tailscale.com/docs/install/cloud/gce\\#step-3-advertise-routes-from-the-vm)\r\n\r\nTo enable connections from your tailnet to the GCP subnet, configure the VM to act as a [subnet router](https://tailscale.com/docs/features/subnet-routers).\r\n\r\nFirst, enable IP forwarding on the VM.\r\n\r\nIf your Linux system has a `/etc/sysctl.d` directory, use:\r\n\r\n```shell\r\necho 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf\r\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf\r\nsudo sysctl -p /etc/sysctl.d/99-tailscale.conf\r\n```\r\n\r\nOtherwise, use:\r\n\r\n```shell\r\necho 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf\r\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf\r\nsudo sysctl -p /etc/sysctl.conf\r\n```\r\n\r\nAfter enabling IP forwarding, configure the VM to advertise routes for the subnet it sits on. For example, if the subnet address range is `10.182.0.0/24`, the command would be:\r\n\r\n```shell\r\ntailscale set --advertise-routes=10.182.0.0/24 --accept-dns=false\r\n```\r\n\r\nFor GCE VMs it is generally best to let Google handle the DNS configuration, not have Tailscale override it, so we added `--accept-dns=false`.\r\n\r\n## [Step 4: Add GCE DNS for your tailnet](https://tailscale.com/docs/install/cloud/gce\\#step-4-add-gce-dns-for-your-tailnet)\r\n\r\nFor the benefit of the _other_ nodes in the tailnet we'll set up [split DNS](https://tailscale.com/docs/reference/dns-in-tailscale#tailscale-dns-settings) to allow use of the same DNS names as the ones that are inside of GCE.\r\n\r\nThe hostnames inside of GCE are of the form:\r\n\r\n```shell\r\n..internal\r\n```\r\n\r\nUse the Google Cloud CLI command [`gcloud dns policies create`](https://cloud.google.com/sdk/gcloud/reference/dns/policies/create) to create a new [Cloud DNS](https://cloud.google.com/dns) policy that lets inbound forwarding for your tailnet:\r\n\r\n```shell\r\ngcloud dns policies create inbound-dns \\\r\n --project=\"YOUR_VPC_PROJECT\" \\\r\n --description=\"Expose DNS endpoints per subnet\" \\\r\n --networks=\"YOUR_VPC\" \\\r\n --enable-inbound-forwarding\r\n```\r\n\r\nwhere:\r\n\r\n- `YOUR_VPC_PROJECT` is your Google Cloud [project ID](https://cloud.google.com/sdk/gcloud/reference#--project).\r\n- `YOUR_VPC` is the comma separated list of network names to associate with the policy.\r\n\r\nUse the [`gcloud compute addresses list`](https://cloud.google.com/sdk/gcloud/reference/compute/addresses/list) to verify that your tailnet recognizes the DNS resolver for your tailnet subnet:\r\n\r\n```shell\r\ngcloud compute addresses list \\\r\n --project=\"YOUR_VPC_PROJECT\" \\\r\n --filter='purpose=\"DNS_RESOLVER\"' \\\r\n --format='csv(address, region, subnetwork)' \\\r\n | grep YOUR_TAILNET_SUBNET\r\n```\r\n\r\nwhere:\r\n\r\n- `YOUR_VPC_PROJECT` is your Google Cloud [project ID](https://cloud.google.com/sdk/gcloud/reference#--project).\r\n- `YOUR_TAILNET_SUBNET` is your subnet machine name.\r\n\r\nUse the IP address returned from this command as a DNS resolver for your tailnet:\r\n\r\n1. Open the [DNS](https://login.tailscale.com/admin/dns) page in the admin console.\r\n\r\n2. Select **Add name server**.\r\n\r\n3. Select **Custom**.\r\n\r\n4. For **Nameserver**, enter the IP address from the `gcloud compute addresses list` command that you ran above. In this example, we use `10.243.117.59`.\r\n\r\n5. Ensure **Restrict to search domain** is checked.\r\n\r\n6. For **Search Domain**, enter **internal**.\r\n\r\n7. Select **Save**.\r\n![The Add nameserver configuration with an IP address and Search Domain set to internal.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgce-add-nameserver.4bd56bd3.png&w=3840&q=75)\r\n\r\nNow the same hostnames which work between nodes running within GCE will also be available to all nodes in your tailnet.\r\n\r\n## [Step 5: Remove public SSH access](https://tailscale.com/docs/install/cloud/gce\\#step-5-remove-public-ssh-access)\r\n\r\nAs we can now SSH to the system over the private Tailscale network, there is no reason to leave the SSH port open on a public IP address. You can delete the `default-allow-ssh` rule from **VPC network** \\> **Firewall**.\r\n\r\n![The firewall rule details for an example project highlighting a the Delete command in the top right.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgce-remove-ssh.fc7a024a.png&w=3840&q=75)\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Access Google Compute Engine VMs privately using Tailscale

\n

Last validated: Dec 4, 2025

\n

Google Cloud provides Linux virtual machines and you can use Tailscale to provide secure connectivity.

\n

Prerequisites

\n

Before you begin this guide, you'll need a Tailscale network (known as a tailnet) set up and configured with at least one existing device. Read our getting started guide if you need help with this.

\n

Step 1: Set up the Tailscale client for the VM

\n

First, create a Virtual Machine in the GCE Console.

\n

When creating the instance select Management, security, disks, networking, sole tenancy, select Networking, and select the Network Interface. Because we're later going to enable subnet routing on this VM, we want to set IP forwarding to On.

\n

\"The

\n

Once you create the VM, SSH to the system and follow the steps to install Tailscale on Linux.

\n

Step 2: Allow UDP port 41641

\n

If at least one side of a tunnel has \"easy NAT,\" where Tailscale can determine the UDP port number on the far side of the NAT device, then it will make direct connections to minimize latency.. We ensure that GCE nodes can make direct connections by allowing UDP port 41641 to ingress through the firewall.

\n

In VPC Network > Firewall we add two rules:

\n
    \n
  1. An ingress rule to allow 0.0.0.0/0 for UDP port 41641 to all instances.
    2. \n
  2. An ingress rule to allow ::/0 for UDP port 41641 to all instances.
    3. \n
\n

\"The

\n

Step 3: Advertise routes from the VM

\n

To enable connections from your tailnet to the GCP subnet, configure the VM to act as a subnet router.

\n

First, enable IP forwarding on the VM.

\n

If your Linux system has a /etc/sysctl.d directory, use:

\n
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf\r\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf\r\nsudo sysctl -p /etc/sysctl.d/99-tailscale.conf\n
\n

Otherwise, use:

\n
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf\r\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf\r\nsudo sysctl -p /etc/sysctl.conf\n
\n

After enabling IP forwarding, configure the VM to advertise routes for the subnet it sits on. For example, if the subnet address range is 10.182.0.0/24, the command would be:

\n
tailscale set --advertise-routes=10.182.0.0/24 --accept-dns=false\n
\n

For GCE VMs it is generally best to let Google handle the DNS configuration, not have Tailscale override it, so we added --accept-dns=false.

\n

Step 4: Add GCE DNS for your tailnet

\n

For the benefit of the other nodes in the tailnet we'll set up split DNS to allow use of the same DNS names as the ones that are inside of GCE.

\n

The hostnames inside of GCE are of the form:

\n
<vm-name>.<gce-project-name>.internal\n
\n

Use the Google Cloud CLI command gcloud dns policies create to create a new Cloud DNS policy that lets inbound forwarding for your tailnet:

\n
gcloud dns policies create inbound-dns \\\r\n  --project=\"YOUR_VPC_PROJECT\" \\\r\n  --description=\"Expose DNS endpoints per subnet\" \\\r\n  --networks=\"YOUR_VPC\" \\\r\n  --enable-inbound-forwarding\n
\n

where:

\n\n

Use the gcloud compute addresses list to verify that your tailnet recognizes the DNS resolver for your tailnet subnet:

\n
gcloud compute addresses list \\\r\n  --project=\"YOUR_VPC_PROJECT\" \\\r\n  --filter='purpose=\"DNS_RESOLVER\"' \\\r\n  --format='csv(address, region, subnetwork)' \\\r\n  | grep YOUR_TAILNET_SUBNET\n
\n

where:

\n\n

Use the IP address returned from this command as a DNS resolver for your tailnet:

\n
    \n
  1. \n

    Open the DNS page in the admin console.

    \n
    2. \n
  2. \n

    Select Add name server.

    \n
    3. \n
  3. \n

    Select Custom.

    \n
    4. \n
  4. \n

    For Nameserver, enter the IP address from the gcloud compute addresses list command that you ran above. In this example, we use 10.243.117.59.

    \n
    5. \n
  5. \n

    Ensure Restrict to search domain is checked.

    \n
    6. \n
  6. \n

    For Search Domain, enter internal.

    \n
    7. \n
  7. \n

    Select Save.\r\n\"The

    \n
    8. \n
\n

Now the same hostnames which work between nodes running within GCE will also be available to all nodes in your tailnet.

\n

Step 5: Remove public SSH access

\n

As we can now SSH to the system over the private Tailscale network, there is no reason to leave the SSH port open on a public IP address. You can delete the default-allow-ssh rule from VPC network > Firewall.

\n

\"The

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}