Skip to content
Documentation
Infrastructure as a Service
Compute
Guides
SSH Access from the Internet

Accessing Virtual Machines over SSH from the Internet

Virtual machine instances (VMIs) in Thalassa Cloud run inside your VPC and are not reachable from the public internet by default. This guide explains the recommended way to access a VMI over SSH from the public internet today, and what to expect once managed VPN access is available.

Note

Thalassa Cloud does not yet support attaching public IP addresses directly to virtual machine instances. To reach a VMI from the internet, expose SSH through a load balancer instead.

Prerequisites

  • A virtual machine instance running in a VPC subnet
  • SSH key-based authentication configured on the instance (for example via cloud-init)
  • Permission to create load balancers, listeners, target groups, and security groups in the same VPC

Recommended approach: load balancer on port 22

Use a public load balancer with a TCP listener on port 22 that forwards traffic to a target group containing your VMI on port 22.

Internet  →  Load balancer (TCP :22)  →  Target group  →  VMI (TCP :22)

Step 1: Create a target group

  1. In the Thalassa Cloud Console, go to IaaS → Networking → Target Groups (or create the target group from your preferred API / Terraform workflow).
  2. Create a target group in the same VPC as your virtual machine.
  3. Register your VMI as a target on port 22.
  4. Configure a TCP health check on port 22 so the load balancer only forwards traffic when SSH is reachable on the instance.

Step 2: Create a load balancer and SSH listener

  1. Create a load balancer in the same VPC.
  2. Add a listener with:
    • Protocol: TCP
    • Port: 22
    • Forward to: the target group created in Step 1
  3. Wait until the load balancer is provisioned and the target is marked healthy. The load balancer will be provisioned a public IP automatically.

Step 3: Restrict internet access

Exposing SSH to the entire internet is risky. Restrict who can connect using at least one of the following:

  • Listener ACLs — allow only trusted source IP addresses or CIDR ranges on the SSH listener.
  • Security groups — attach security groups to the load balancer that allow inbound TCP 22 only from known sources. See Working with Security Groups.

Prefer the narrowest source ranges you can (for example your office or bastion egress CIDRs). Avoid 0.0.0.0/0 on port 22 unless you have a clear operational need and compensating controls.

Step 4: Connect over SSH

Once the target is healthy, connect using the load balancer’s public IP address:

ssh -i /path/to/private_key user@<LOAD_BALANCER_IP>

Replace user with the OS user configured on the instance (for example ubuntu on Ubuntu images).

Security recommendations

  • Prefer SSH keys over passwords; disable password authentication where possible.
  • Keep listener ACLs and security group rules limited to operators who need access.
  • Review health check and listener settings after changes so you do not accidentally leave SSH open more broadly than intended.
  • For troubleshooting connectivity through the load balancer, see the guidance in Load Balancers.

Coming soon: WireGuard VPN

In the near future, Thalassa Cloud will offer a managed WireGuard VPN service. Once that service launches, the recommended way to reach virtual machine instances inside your VPC will be over the WireGuard VPN rather than exposing SSH on a public load balancer.

Until then, use a load balancer with a restricted SSH listener as described above.

Related documentation

Updating Ubuntu