The SSH in Browser from Google Cloud is quite a useful feature allows you to connect to connect to your virtual machines over SSH directly from their online dashboard.

Immensely helpfull when dealing with networks that keep dropping packets and blocking any else than HTTP. I'm looking at you coffee shops ...

But coming from a security standpoint the first thing I tend to do on new projects is disabled any external ssh connections as that just reduces my attack vector substantially.

But after doing this you soon discover that you cannot connect to your VM's using the web-based SSH console anymore. Whelp ...

This does seem like a way to give you complete control over who can connect to your VM's but makes it a bit harder trying to setup authorised IP's.

For now (here's to hoping this just becomes a setting it the future) Google requires you to just allow their IP ranges.

You can find the IP ranges by querying the 8.8.8.8 DNS server provided by them for TXT records using:

nslookup -q=TXT _spf.google.com 8.8.8.8  

which should respond with something like:

Server:   8.8.8.8  
Address:  8.8.8.8#53

Non-authoritative answer:  
_spf.google.com text = "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"

...

Where after you can query each one of the listed subdomains and get the IP's using:

nslookup -q=TXT _netblocks.google.com 8.8.8.8  
nslookup -q=TXT _netblocks2.google.com 8.8.8.8  
nslookup -q=TXT _netblocks3.google.com 8.8.8.8  

which will give you a nice list of IP's that can be added to your firewall rules. For example _netblocks.google.com returns:

Server:   8.8.8.8  
Address:  8.8.8.8#53

Non-authoritative answer:  
_netblocks.google.com text = "v=spf1 ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"

...

You'll need to update your list every time the console stops working from the dashboard again. But you will be able to connect now.