Currently, assuming you've VPN tool uses internal ip to ssh, this should be customised and should take `instance.ExternalIP()` based on flag.