How to Fix SSH Connection Timed Out
Diagnose SSH timeouts by checking DNS, routing, firewalls, security groups, ports, proxies, and whether the server is reachable.
An SSH connection timeout means the client did not complete a TCP connection to the destination before its deadline. Unlike Connection refused, a timeout usually points to dropped traffic, an unreachable route, the wrong address, or a host that is offline.
Confirm the effective destination
SSH aliases, proxies, and jump hosts can change where the client actually connects:
ssh -G example.com | grep -E '^(hostname|port|user|proxyjump|proxycommand) '
ssh -vvv user@example.com
The verbose output shows whether SSH stalls during DNS resolution, proxy setup, or the connection to the target address.
Test DNS and the TCP port
getent ahosts example.com
nc -vz -w 5 example.com 22
On systems without getent, use dig or nslookup. If the hostname returns several addresses, test each one. An obsolete AAAA record can cause IPv6 attempts to time out while IPv4 still works:
ssh -4 user@example.com
ssh -6 user@example.com
These flags are diagnostic tools; correct the DNS or routing issue instead of permanently forcing an address family without understanding the cause.
Inspect the network path
traceroute example.com
Some networks drop traceroute traffic, so missing hops do not prove where SSH is blocked. Compare the result from another trusted network or a host in the same region.
Check server and cloud firewalls
Use a cloud console, bastion, or out-of-band access to inspect the server:
sudo ss -ltnp | grep -E ':22\s'
sudo ufw status verbose
sudo firewall-cmd --list-all
sudo nft list ruleset
Also inspect cloud security groups, network ACLs, VPN routes, and corporate egress policy. Restrict SSH access to trusted addresses rather than opening port 22 globally.
Diagnose it with Rumus
Rumus is an AI-native terminal that connects to your real SSH hosts and understands the active connection context. It can inspect SSH configuration, identities, network paths, and server logs instead of guessing from an isolated chat.
What Rumus can inspect
- SSH config, keys, and effective connection settings
- Jump hosts, proxies, ports, and network reachability
- Server authentication logs and file permissions
Open a local Rumus workspace or a reachable host on the same network and ask:
Diagnose why SSH to example.com times out. Show the effective SSH destination,
DNS answers, IPv4 and IPv6 behavior, target port reachability, proxy and jump-host
settings, and the available network path. If server access exists, inspect the
listener and firewall read-only. Do not change firewall rules without approval.
Confirm the fix
Repeat the TCP and SSH tests:
nc -vz -w 5 example.com 22
ssh -vvv user@example.com
Once the connection reaches an SSH banner, any subsequent authentication error is a separate account or key issue.
Open the server in Rumus and let the AI agent inspect context, propose a plan, and ask before it runs changes.