Troubleshooting

Error "Timeout waiting for TCP tunnel to be created. Check that the respective VM instance permits RDP ingress traffic from Cloud IAP."

1. Verify that your VPC permits ingress traffic from Cloud IAP.
2. Check that your firewall rules allow TCP ingress traffic from Cloud IAP to port 3389 of your VM instance.

Desktop firewall warnings

For each VM instance you connect to via Cloud IAP, IAP Desktop opens a TCP socket that listens on 127.0.0.1 (using a dynamic port number). This port is necessary to relay the RDP traffic from the Remote Desktop component to Cloud IAP.

Other errors

If you are seeting other error messages, try manually establishing a Cloud IAP TCP forwarding tunnel:

1. If you have not installed the Cloud SDK yet, download and install it first.
2. Open a command prompt window (cmd.exe).
3. Run the following command: gcloud compute start-iap-tunnel [INSTANCE_NAME] 3389 --project=[PROJECT] --zone=[ZONE] --local-host-port=localhost:13389 Replace [INSTANCE_NAME] by the name of an instance and [PROJECT] and [ZONE] by the project and zone the instance is located in.
4. Wait for the output Listening on port [13389]. to appear.
5. Launch mstsc.exe and try to connect to localhost:13389.

If establishing the tunnel does not work, check if a local firewall is blocking gcloud from binding to a local port or blocking communication with Cloud IAP.