Connect with SSH

A new VM is closed to the internet: its security group denies all inbound traffic. You open port 22 for your own address, then connect over IPv6 (free, every VM has one) or IPv4 (needs a public IPv4 address, billed monthly).

1. Allow SSH in the security group

Every VPC has a default security group: VMs in it reach each other, all outbound traffic is allowed, and everything else inbound is denied. Add one rule for SSH. Allow only your own network if you can; 0.0.0.0/0 (IPv4) and ::/0 (IPv6) mean the whole internet.

Console

1. In the project, open Security groups → default.
2. Add rule: direction inbound, protocol TCP, port 22, source your address (for example 203.0.113.7/32, or your IPv6 prefix).
3. Save. Rules apply at once, also to running VMs.

CLI

SG=$(tebib -o json security-group list | jq -r '.[] | select(.name == "default") | .id')
tebib security-group rule add "$SG" --protocol tcp --port 22 --cidr 203.0.113.7/32 --description "SSH from home"
tebib security-group rule add "$SG" --protocol tcp --port 22 --cidr 2001:db8:1234::/48 --description "SSH from home (IPv6)"

Replace the example ranges with your own. Find your public addresses with curl -4 https://ifconfig.co and curl -6 https://ifconfig.co.

2. Log in

The login user depends on the image:

Image	User
Ubuntu	ubuntu
Debian	debian
Rocky Linux	rocky
AlmaLinux	almalinux

Over IPv6

If your network has IPv6 (most Kenyan mobile networks do), use the VM’s IPv6 address from its page or tebib vm show:

ssh ubuntu@2001:db8:5a:1121:2::6

Over IPv4

IPv4 addresses are scarce, so a VM doesn’t get one unless you ask. Public IPv4 addresses reach VMs through the VPC’s NAT gateway, so the VPC needs one first (the gateway itself is free and doesn’t need an address of its own). Then allocate an address and point it at the VM. A new organization can hold 1 public IPv4 address; it bills by the hour while it’s allocated to your project, attached or not.

Console

1. Network: add a NAT gateway to the default VPC (leave its public IP empty).
2. Public IPs → Allocate, then Associate it with the VM.
3. ssh ubuntu@<the address>.

CLI

SUBNET=$(tebib -o json vm show "$VM" | jq -r .subnet_id)
tebib nat-gateway create default-nat --subnet "$SUBNET" --wait
IP=$(tebib -o json public-ip allocate web-1-ip --wait | jq -r .id)
tebib public-ip associate "$IP" --vm "$VM" --wait
tebib public-ip show "$IP"

The VM’s own outbound traffic now leaves from that address too. See Public IPs.

It doesn’t connect

• Timeout: the security group doesn’t allow your address yet, or you’re connecting over IPv4 without a public IPv4 address. Check the rule’s source range against your real address.
• Permission denied (publickey): wrong user for the image, or the key isn’t the one you added. Keys are installed at the VM’s first boot only: a key added to the project later doesn’t reach an existing VM.
• Connection refused or the host is still booting: first boot installs updates and the guest agent; give it two to four minutes.
• Still stuck? Open the serial console from the VM’s page (or tebib vm console <VM ID>) to see the boot log. See VM console and Troubleshooting.

You’re done. Next, read about security groups, volumes or automating with cloud-init.