Q:

WinSCP to google cloud

I have google cloud compute engine instance.  I'm trying to connect using winSCP.  I followed the steps by https://cloud.google.com/compute/docs/instances/connecting-to-instance
It is stating "Connection Timed out error" What should be the cause.  Should I need to open firewall in google cloud?  But it doesn't shown in the instruction.  

A:

Yes, you should have a GCE firewall rule added for SSH protocol to allow this traffic to the VM instances that you want to connect.  This is a quote from this article:

Each network has its own firewall controlling access to the instances. 
All traffic to instances, even from other instances, is blocked by the
  firewall unless firewall rules are created to allow it. 
The default network has automatically created firewall rules, which
  are shown below.  No manually created network of any type has
  automatically created firewall rules.  For all networks except the
  default network, you must create any firewall rules you need. 
Firewall rules are only "allow" rules.  You cannot create "deny" rules. 
  If you need to restrict traffic from reaching certain instances,
  create rules that allow traffic to the other instances, then remove
  the firewall rule that allowed traffic to all of the instances. 
The firewall rules automatically created for the default network are
  as follows:
default-allow-internal
Allows network connections of any protocol and
  port between instances on the network.  
default-allow-ssh 
Allows SSH connections from any source to any instance on the network over > TCP port 22.  
default-allow-rdp 
Allows RDP connections from any source to any instance on the network over > TCP port 3389.  
default-allow-icmp
Allows ICMP traffic from any source to any instance on the network.