ssh: connect to host port 22: Connection timed out
Connection timed out means your SYN packets got no reply: a firewall dropped them, the host is down, or you have the wrong address. It is different from Connection refused, which means something on that host actively rejected the port.
Timeout vs refused vs no route
| Message | What it means |
|---|---|
Connection timed out | No reply to TCP connect. Packets filtered or host unreachable/silent. |
Connection refused | Host reachable, but nothing accepted the port (sshd down or wrong port). |
No route to host / Network is unreachable | Routing or interface problem before you even reach the server. |
Permission denied (publickey) | TCP and SSH worked; authentication failed. Different guide. |
Check the path first
# Linux / macOS / WSL
nc -vz example.com 22
# or: timeout 5 bash -c 'echo >/dev/tcp/example.com/22' && echo open
# Windows PowerShell
Test-NetConnection example.com -Port 22
# TcpTestSucceeded : False + long wait ≈ timeout / filter
# TcpTestSucceeded : False quickly with connection refused ≈ nothing listeningAlso confirm DNS and address: dig +short HOST / Resolve-DnsName HOST, and that you are using the public IP your cloud console shows, not an old elastic IP or a private VPC address from outside the VPC.
Usual causes of a timeout
- Wrong IP or host: typo, stale inventory, or connecting to a private
10./172.16./192.168.address from the public internet. - Cloud security group / firewall: AWS / GCP / Azure network rules must allow your client IP (or bastion) to the SSH port. Changing the server’s
ufwdoes nothing if the cloud edge drops the packet first. - Host firewall:
ufw status,firewall-cmd, iptables/nftables on the server (via console) may allow 22 only from certain CIDRs. - Host down or still booting: provider console / serial access shows whether the VM is running.
- ISP or hotel network blocking outbound 22: try a phone hotspot. Many networks allow
443only; run sshd on 443 or use a VPN /ProxyJumpthrough a host that can reach it. - SSH not on 22: some hosts listen elsewhere.
ssh -p 2222 user@hostor aPortline in~/.ssh/config. Some setups are not on 22 at all (for example a web tunnel in front of an app) — a timeout on 22 can simply mean “nothing there”, not “open the port”.
Once the port answers
ssh -v user@host # see where it hangs
ssh -J bastion user@internal # ProxyJump through a reachable bastion
ssh -o ConnectTimeout=5 user@hostVerbose mode shows DNS, the TCP connect, then the key exchange. If it hangs before “Remote protocol version”, you are still in network land. After you get a publickey or password prompt, use the Permission denied (publickey) guide.
Localhost cousins
Talking to a process on your own machine is a different class of error: localhost refused to connect and ECONNREFUSED ::1 mean nothing is listening on that local port (or you hit IPv6 vs IPv4), not that a remote firewall timed out.
Related
ssh Connection refused port 22 · TCP works but keys fail: Permission denied (publickey). Key file permissions too open: SSH key permissions are too open. App on your laptop not listening: localhost refused to connect. Host key suddenly differs: REMOTE HOST IDENTIFICATION HAS CHANGED. Browser says the name itself is unknown: ERR_NAME_NOT_RESOLVED.
Questions
What does ssh Connection timed out mean?
Your client got no TCP reply on that host and port. Typical causes are a cloud security group, host firewall, wrong IP, a machine that is powered off, or a network that blocks outbound port 22.
How is Connection refused different from timed out?
Refused means the host answered and actively rejected the port (sshd not listening or wrong port). Timed out means silence: usually filtering or unreachability.
How do I test if port 22 is open?
Use nc -vz host 22 on Linux/macOS, or Test-NetConnection host -Port 22 in PowerShell. A quick refuse vs a long hang tells refused from timeout.
Can I use another port if 22 is blocked?
Yes, if the server listens there: ssh -p 443 user@host. Some networks block 22 but allow 443. A VPN or ProxyJump through a bastion also works.
Published .