How to SSH into an Oracle Cloud VM Without a Public IP Using Cloud Shell
One of the advantages of Oracle Cloud Infrastructure (OCI) is that you don't necessarily need to assign a public IP address to every VM instance.
For servers that only need to be accessed for administration, development, or internal services, keeping them on a private network is often a better approach.
But this raises a question:
How do you SSH into a VM that has only a private IP address and is not directly accessible from the public internet?
You can use Oracle Cloud Shell.
In this tutorial, I'll walk through how to connect to an Oracle Cloud VM through its private VCN using Cloud Shell, without assigning a public IP address to the VM.
1. The architecture
The idea is straightforward:
Create a VM instance inside an OCI Virtual Cloud Network (VCN).
Do not assign a public IP address to the VM.
Configure Oracle Cloud Shell to connect to the same VCN.
Upload the SSH private key used when creating the VM into Cloud Shell.
SSH into the VM using its private IP address.
The connection looks like this:
Your Computer
|
| HTTPS
v
Oracle Cloud Console
|
v
Oracle Cloud Shell
|
| Private Network / VCN
|
| SSH (TCP 22)
v
Private VM Instance
10.0.0.84
Your VM does not need a public IP address. SSH traffic travels through the private network connection provided by Cloud Shell.
2. Create a VM without a public IP address
First, create your VM instance in Oracle Cloud Infrastructure.
For this example, I created an ARM-based Oracle Linux 9 instance with the following configuration:
| Configuration | Value |
|---|
| Instance name | oci-qzl-vnic-1 |
| Operating system | Oracle Linux 9 |
| Architecture | ARM64 (aarch64) |
| CPU | 2 OCPUs |
| Memory | 12 GB |
| Boot Volume | 50 GB |
| Private IP | 10.0.0.84 |
| Public IP | None |
During VM creation, OCI asks you to configure an SSH key pair.
Choose to generate a key pair or provide your own public key.
Important: Download and save the private key securely. You will need this key later to authenticate your SSH connection.
The private key is usually downloaded as a .key file.
Do not lose it. OCI does not keep a copy of your private key for you.
3. Configure Cloud Shell to connect to your VCN
This is the most important step.
By default, Oracle Cloud Shell uses its default public network. In that configuration, it cannot necessarily reach your VM through its private IP address.
Fortunately, Cloud Shell supports connecting to a private network.
Open Cloud Shell from the Oracle Cloud Console.
At the top of the Cloud Shell window, find the network selector.
It may initially display:
Network: Ephemeral
Click the network selector or the adjacent Details link.
You will see several options:
Choose Ephemeral private network setup.
Follow the setup process to select the VCN and subnet where your VM resides.
For my configuration, Cloud Shell connected to:
| Configuration | Value |
|---|
| VCN compartment | oci-qzl |
| VCN name | vcn-20261104-2006 |
| Subnet compartment | oci-qzl |
| Subnet name | subnet-20261104-2006 |
| Connection state | Connected |
After setup, click Details to verify the connection.
You should see the VCN name and subnet name, along with a Connected status.
Now Cloud Shell has a private network connection to your VCN.
Note: Cloud Shell's ephemeral private network is temporary. It is not a permanent VM or a replacement for a VPN or bastion service.
4. Upload your SSH private key to Cloud Shell
Configuring the network only solves connectivity. We still need to authenticate with the VM.
Remember the SSH private key downloaded when creating the VM?
We need to upload that file into Cloud Shell.
Cloud Shell provides an upload option in its Actions menu.
Upload your private key file.
For example, assume the uploaded file is named:
ssh-key-2026-11-05.key
Make sure the key is stored in your .ssh directory.
mkdir -p ~/.ssh
chmod 700 ~/.ssh
If the uploaded file is in your current directory, move it:
mv ssh-key-2026-11-05.key ~/.ssh/
Set the correct file permissions:
chmod 400 ~/.ssh/ssh-key-2026-11-05.key
SSH requires private key files to have appropriately restrictive permissions.
Security tip: Never share your private key or paste its contents into chat messages, logs, or public repositories. Delete the uploaded copy from Cloud Shell when you no longer need it.
5. SSH into your VM using its private IP
Now comes the easy part.
For Oracle Linux, the default SSH username is opc.
Run:
ssh -i ~/.ssh/ssh-key-2026-11-05.key opc@10.0.0.84
Replace the key filename and private IP address with your own values.
The first time you connect, SSH may display a message similar to:
The authenticity of host '10.0.0.84' can't be established.
ECDSA key fingerprint is SHA256:...
Are you sure you want to continue connecting
(yes/no/[fingerprint])?
If you have verified that this is your VM and the host fingerprint is expected, type:
yes
SSH will save the host key in ~/.ssh/known_hosts.
You should now be connected!
For my VM, the terminal prompt changed to:
[opc@oci-qzl-vnic-1 ~]$
That's it. We have successfully logged into an Oracle Cloud VM using its private IP address without assigning it a public IP.
6. Verify the VM
Once connected, you can verify the operating system and hardware configuration.
Check the Linux kernel and architecture:
uname -a
Check CPU information:
lscpu
Check available memory:
free -m
Check disk usage:
df -h
Check disk and partition layout:
lsblk
These commands are useful for verifying that you are connected to the intended VM and understanding its available resources.
7. Troubleshooting
If your connection doesn't work, here are a few common issues.
Connection timed out
Check the following:
Cloud Shell is connected to the correct VCN.
Cloud Shell and the VM are in compatible network configurations.
The VM's subnet security list or Network Security Group allows inbound TCP port 22 from the Cloud Shell private network.
Routing and firewall rules permit the connection.
Permission denied (publickey)
For example:
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
This usually means SSH authentication failed.
Check that:
You uploaded the correct private key.
You are using the correct username (opc for Oracle Linux).
You are specifying the private key with -i.
The private key has restrictive permissions.
Host key verification failed
If you encounter a host key verification error, check whether there is an outdated entry in known_hosts.
You can remove the existing entry with:
ssh-keygen -R 10.0.0.84
Then reconnect and verify the host fingerprint before accepting it.
Conclusion
You don't need to expose your Oracle Cloud VM to the public internet just to administer it.
By configuring Oracle Cloud Shell to use an ephemeral private network connected to your VCN, you can access your VM through its private IP address.
The important steps are:
Create a VM without a public IP.
Configure Cloud Shell's ephemeral private network to connect to the VM's VCN and subnet.
Upload the original SSH private key into Cloud Shell.
Use SSH with the private IP and the correct username.
This is a convenient approach for managing private Oracle Cloud instances without setting up a public SSH endpoint.
For personal projects, development environments, and private infrastructure, it's a simple option worth knowing about.
Keep your servers private whenever public access is not necessary.
❤️ Support This Blog
If this post helped you, you can support my writing with a small donation.
Thank you for reading.
Comments
Post a Comment