How to Create an Oracle Cloud Always Free A1 Instance - Public IP Connection and SSH Security Setup

Overview

This post summarizes how to create an A1 (ARM) instance on the Oracle Cloud Infrastructure (OCI) Always Free tier.

As of the date this post was written (2026-07-10), the always-free spec is 2 OCPUs, 12GB memory, and 200GB disk.

Even if you split the OCPU quota to run two instances, you can still stay within the free tier.

This post covers everything from creating a Compute instance to selecting the OS and spec, network, SSH key, and boot volume settings, and connecting a public IP.

It then covers cleaning up the default Any inbound rule for port 22 in the VCN Security List, and how to restrict access using a Network Security Group or a VPN.

Finally, it includes verifying the SSH connection.

Creating the Oracle Server

Creating an instance

Compute → Instacnes → [Create instance]

Basic instance information

Selecting the OS

You’re free to choose the OS, but since A1 is an ARM processor, you must choose an aarch64 image.

Selecting the spec

• The always-free spec as of the date this post was written (2026-07-10): 2 OCPU + Memory 12GB + Disk 200GB
• Since this is a maximum usage limit, you can also use just 1 OCPU and create 2 instances for free

Next step

Security settings will be handled separately

Creating the network

Creating and downloading the SSH key

• Download the SSH private key for connecting to the server, along with the public key

Creating the volume (disk)

• Free up to 200GB
• Created as a boot volume since there’s no need to manage the disk separately
• Boot volume + block volume combined are free up to 200GB
• Boot volume: the main disk
• Block volume: an expansion disk

Create after reviewing

Creating

Creation complete

Viewing the instance

Connecting to the Internet - Public Network Setup

Instance → Networking → VNIC

Editing the VNIC’s IP

Create a reserved IP and attach it

Creation complete

Quick navigation

Or navigate via the menu

Security Settings

The security firewall of an Oracle Cloud server is controlled primarily through the VCN’s Security List and Network Security Group.

By default, the VCN’s Security List has port 22 for remote access open to Any, so follow-up action is required.

Blocking the Default Any (0.0.0.0/0) Inbound Rule for Port 22 in the VCN

Navigate from the instance to the VCN settings

Delete the Any-open rule

• Delete ICMP only if necessary

Allowing Access

Choose one of the following methods

1. Register your IP in the VCN Security List entry.
2. Register the IP with the instance’s VNIC Network Security Group to allow access.
3. Allow temporary access using method 1 or 2, then access through a VPN (Tailscale, OpenVPN, etc.)

Allowing Access via a VCN Network Security Group

Do this in the corresponding VCN

Navigate to the corresponding instance’s Primary VNIC settings

Connect and save

Verifying the Connection

 1Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 6.17.0-1011-oracle aarch64)
 2
 3 * Documentation:  https://help.ubuntu.com
 4 * Management:     https://landscape.canonical.com
 5 * Support:        https://ubuntu.com/pro
 6
 7This system has been minimized by removing packages and content that are
 8not required on a system that users do not log into.
 9
10To restore this content, you can run the 'unminimize' command.
11
12The programs included with the Ubuntu system are free software;
13the exact distribution terms for each program are described in the
14individual files in /usr/share/doc/*/copyright.
15
16Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
17applicable law.
18
19To run a command as administrator (user "root"), use "sudo <command>".
20See "man sudo_root" for details.
21
22ubuntu@xxxxx:~$

Wrap-Up

An OCI Always Free A1 instance is a setup that lets you run an ARM server right away within the free limits.

You need to attach a public IP for external access, and the default Any inbound rule for port 22 in the Security List must be cleaned up.

In practice, it’s recommended to register allowed IPs in an NSG or to access indirectly through a VPN such as Tailscale.

Keep your SSH key stored safely, and minimizing exposure of port 22 to the public is the basic rule.

Once you’ve completed these steps, you’ll have gone from creating the A1 server to having a secure access path in place.

References

• Oracle Cloud Always Free resources (official docs)
• Security Lists (official docs)