Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
AWS port 22 “Connection timed out” means your SSH client received no response from the EC2 instance. Start with the network path—not the SSH key or sshd: verify the target and health checks, allow TCP 22 from your current public IPv4 address in the effective security group, confirm a public address and internet-gateway route, check network ACL return traffic, and rule out local or intermediate firewalls. Only after those checks should you inspect the host. A timeout is different from “Connection refused,” which means the host answered but no service accepted the connection.
The sequence below follows the path from your computer to the instance. Stop when a check identifies a block, correct that layer, and retest before changing anything else.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What does “AWS port 22 connection timed out” mean?
TCP port 22 is the usual SSH endpoint. During a timeout, packets or replies are being dropped somewhere between your client and the instance, so the SSH program eventually gives up. The instance may be running normally; the failure can be a security group, route, address, network ACL, firewall, or an incorrect destination.
AWS documentation distinguishes the messages by layer. A refused connection reaches the host, but nothing is listening on port 22 (or the host firewall rejects it). Permission denied (publickey) occurs later, after a connection and SSH authentication exchange have already succeeded.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Message | Most likely layer | First checks |
|---|---|---|
| Connection timed out | Network path or filtering | Security group, public address, route table and internet gateway, network ACL, local or intermediate firewalls, and status checks |
| Connection refused | Host reached but no listener accepted the connection | SSH service status, listening socket, operating-system firewall, and service configuration |
| Permission denied (publickey) | Authentication | AMI username, private key, and key-file permissions |
Do not spend time replacing keys while the client is still timing out. Authentication cannot begin until the network connection is established.
How do I confirm the EC2 target and instance health?
First make sure you are troubleshooting the intended instance and that AWS reports it as healthy.
- Compare the hostname or IP in your SSH command with the instance you actually intend to manage. A stale address can point to another machine or nowhere at all.
- In the EC2 console, verify that the instance state is running. A stopped instance cannot answer SSH.
- Review both the system status check and the instance status check. A failed check indicates an AWS or guest problem that should be resolved before network debugging continues.
- After any correction, wait for the status checks to pass and test the same address again.
Use the instance’s current address, not an address copied from an earlier launch. If the instance was stopped and started without an Elastic IP, its public IPv4 address may have changed.
How do I check the EC2 security group for port 22?
The effective security-group rules must allow inbound TCP port 22 from the public IPv4 address that your client is using now. AWS’s EC2 User Guide describes the requirement as a rule allowing inbound traffic from your local computer’s public IPv4 address on the proper port.
- Open the instance details and list every security group attached to the network interface. Evaluate the combined inbound rules, not just the group you expected to be attached.
- Confirm the protocol is TCP and the port range includes 22.
- Set the source to your current public IPv4 address as a single-host rule, or to an intentional administrative range. A private address such as
192.168.x.xis not the source an internet-facing instance sees. - Save the rule and retry the connection. If your office, VPN, or mobile connection changes egress addresses, update the source accordingly.
Do not assume the default VPC security group permits internet SSH. AWS states that the default security group does not allow incoming SSH by default. A rule allowing traffic from resources that share the security group is not the same as a rule allowing your computer’s public address.
Security groups are stateful: when an allowed inbound SSH packet reaches the instance, return traffic is automatically permitted by the group. You still need the correct network ACL and route; a permissive security group cannot repair a missing path.
Does the instance have the right public address for an internet SSH connection?
An internet-originated IPv4 connection needs a public IPv4 address or an Elastic IP associated with the instance. Copy that exact address from the instance details and use it as HOST in your SSH command. A private IPv4 address works only from a network that can route to the VPC, such as an approved private connection or management path.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
IPv4 checks
- Confirm the address is present on the instance’s network interface.
- Make sure your SSH command uses the current address, not an old public address retained in a script or bookmark.
- If an Elastic IP is intended, verify that it is associated with this instance and network interface.
IPv6 checks
For an IPv6 connection, the instance must have an IPv6 address, the subnet route table must include an ::/0 route to an internet gateway, and both security-group and network ACL rules must allow the IPv6 traffic. An IPv4 rule for port 22 does not automatically authorize IPv6.
How do I verify the subnet route table and internet gateway?
For public IPv4 SSH, the subnet’s route table needs a default route, 0.0.0.0/0, targeting the VPC internet gateway. Without that route, the instance can have a public address and an apparently correct security group yet remain unreachable from the internet.
- Identify the subnet containing the instance’s network interface.
- Open the route table associated with that subnet; do not inspect an unrelated table in the same VPC.
- Confirm that
0.0.0.0/0points to the VPC internet gateway. - Check that the internet gateway is attached to the VPC and that no more-specific or conflicting route sends the traffic elsewhere.
- Retest after the route is corrected.
Private subnets intentionally omit a direct internet-gateway route. In that design, use a private management channel or a host that has an approved route into the VPC rather than exposing port 22 publicly.
What network ACL rules are required for SSH?
Network ACLs are stateless, so they must permit both directions of the TCP exchange. For an internet client, the custom ACL must allow inbound TCP 22 from the client’s public IP and allow outbound return traffic to the client’s ephemeral ports, 1024–65535. AWS gives this exact inbound-and-return requirement in its EC2 guidance.
- Find the ACL associated with the instance subnet.
- Review inbound rules for TCP destination port 22 and the client source range.
- Review outbound rules for TCP traffic to the client range and ephemeral destination ports 1024–65535.
- Check rule numbers and the first matching rule. A deny rule with a lower rule number can override a later allow.
- If you use IPv6, perform equivalent checks for IPv6 sources and destinations; IPv4 ACL entries do not cover IPv6.
A security group can appear correct while a custom ACL silently drops the request or its reply. That combination commonly produces a timeout rather than an explicit refusal.
Could a local, corporate, or AWS firewall be blocking port 22?
If the instance configuration is correct, inspect controls outside the security group and ACL.
- Corporate egress policy: company networks often restrict outbound TCP 22. Test from an approved network or ask the network administrator whether SSH egress is filtered.
- VPN or proxy path: a VPN can change your public source address or install routes that send VPC traffic to the wrong interface. Disconnecting it briefly, where policy allows, can isolate that variable.
- Client firewall: local endpoint rules may block outbound SSH or the return packets.
- AWS Network Firewall: centrally managed inspection rules can drop the flow even when the subnet ACL and security group allow it.
- VPC Block Public Access: an enabled control can prevent public connectivity that appears otherwise configured.
- Local route conflicts: overlapping address ranges or stale routes can send packets toward the wrong gateway.
Change one control at a time and record the previous rule. Broadly disabling a firewall is not a durable fix; identify the specific port, source, destination, and direction that must be allowed.
Recommended Free Tools
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How can I test the path to port 22?
Use AWS’s modeled analysis first, then a simple TCP probe from the client.
Run VPC Reachability Analyzer
Configure the internet gateway as the source and the instance as the destination, using the relevant protocol and port. A result of Not reachable identifies a modeled block to investigate, such as a route, ACL, security group, or gateway association. The analyzer evaluates AWS configuration; it does not prove that a corporate firewall or an offline client can send packets.
Probe TCP 22 from your computer
Run the following with the instance’s current hostname or public address:
nc -zv HOST 22If netcat is unavailable, the equivalent Telnet probe is:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →telnet HOST 22A successful TCP connection shows that the network path and port are reachable; it does not authenticate you. A timeout confirms that the path is still blocked or that the destination is wrong. Capture the exact output and the source network you used so an administrator can correlate it with firewall logs.
Use verbose SSH after the TCP probe
ssh -i key_pair.pem user@HOST -vvvThe -vvv output helps identify the stage at which the attempt stops. If it never receives a server response, continue network troubleshooting. If it reaches a host-key exchange or an authentication prompt, the timeout problem is resolved and any remaining error belongs to SSH configuration or credentials.
What should I inspect on the instance after the network is reachable?
Inspect the guest only when the route, address, security group, ACL, and external path are plausible. A stopped or misconfigured sshd generally produces “Connection refused” when the host is reachable, not a network timeout.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Connect through Session Manager, EC2 Instance Connect, or the EC2 Serial Console if one is available.
- Check that the SSH service is running and configured to listen on the expected interface and port.
- Inspect listening sockets to confirm that a process is bound to TCP 22.
- Review the operating-system firewall for a rule that rejects or drops SSH.
- Correct the service or firewall configuration, then repeat the
ncand verbose SSH tests.
If the host is reachable but the service is not listening, fix the service layer rather than adding more VPC rules. Conversely, do not edit sshd configuration to solve a path that still times out before reaching the machine.
How can I access an EC2 instance when SSH is unavailable?
Use an alternate management channel while you repair SSH. AWS Systems Manager Session Manager can provide a shell without opening port 22, provided the account and instance satisfy its documented prerequisites. EC2 Instance Connect and the EC2 Serial Console are other possible entry points when enabled and available for your instance and account.
Once inside, you can verify the SSH service, inspect sockets and operating-system firewall rules, and correct a bad configuration without exposing a broad public rule. If no alternate channel is configured, arrange one before the next maintenance change so a single SSH mistake does not remove your only access path.
Which fix should I try first for common timeout scenarios?
| Situation | Most useful first action | Why |
|---|---|---|
| Timeout began after moving from home to an office or VPN | Update the security-group source to the new public IPv4 address and check corporate egress policy | The observed source address or outbound port policy changed |
| Instance was stopped and started | Copy the current public IPv4 address or verify the Elastic IP association | A non-Elastic public address can change after a stop/start |
| Security group allows port 22 but VPC Reachability Analyzer says Not reachable | Follow the analyzer’s blocked component, then inspect the subnet route and ACL | The group is only one control in the modeled path |
| IPv4 works but IPv6 times out | Check the instance IPv6 address, ::/0 route, and IPv6 rules in both controls |
IPv4 and IPv6 paths have separate addressing and rules |
| TCP probe succeeds but SSH reports refusal | Inspect the guest SSH service, listening socket, and OS firewall | The network path is working; the listener is the next layer |
| SSH reaches authentication but says publickey permission denied | Verify the AMI username, private key, and key-file permissions | This is an authentication failure, not a port-22 reachability failure |
How do I make a temporary port-22 fix safer?
Allow the narrowest source range that meets the operational need, preferably the specific public IPv4 address or an intentional administrative range. Avoid treating a broad internet-wide rule as a permanent repair. After testing, remove temporary entries and document which route, group, ACL, or firewall change restored access.
Keep at least one tested alternate management path before changing SSH or network controls. That precaution lets you reverse a bad rule through Session Manager, EC2 Instance Connect, or the Serial Console instead of relying on a connection that may already be blocked.
Free tools Windows power users keep installed
One-click scans. No signup required.
As an optional shortcut after the manual checks, Outbyte PC Repair can address some common Windows system issues and related settings while you investigate the client side; it complements an antivirus rather than replacing one. It offers a free trial by category for at least two days, then requires a subscription, and results vary—no tool repairs every crash or network failure.
Frequently asked questions
Can I use a private EC2 address from my laptop?
Only if your laptop has an approved network route into the VPC, such as a private connectivity arrangement. A private address is not reachable from the public internet, so adding an internet-facing security-group rule alone will not make it work.
Why does the same instance work from one network but time out from another?
The two networks may present different public source IPv4 addresses, or one may block outbound TCP 22. Compare the effective security-group source with the network you are using and check the organization’s egress policy.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Is opening port 22 enough when using IPv6?
No. IPv6 requires an IPv6 address on the instance, an ::/0 route to the internet gateway, and matching IPv6 permissions in the security group and network ACL. IPv4 entries do not authorize IPv6 traffic.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat does a successful netcat test prove?
It proves that a TCP connection to the specified host and port completed from that client at that moment. It does not verify the SSH username, private key, operating-system policy, or authorization.
When should I stop changing AWS networking rules?
Stop when the TCP probe reaches the host or the SSH client advances to key exchange or authentication. At that point, further VPC changes can obscure the real issue; investigate the SSH service, host firewall, username, or key instead.
Frequently Asked Questions
Can I use a private EC2 address from my laptop?
Only if your laptop has an approved network route into the VPC, such as a private connectivity arrangement. A private address is not reachable from the public internet, so adding an internet-facing security-group rule alone will not make it work.
Why does the same instance work from one network but time out from another?
The two networks may present different public source IPv4 addresses, or one may block outbound TCP 22. Compare the effective security-group source with the network you are using and check the organization’s egress policy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is opening port 22 enough when using IPv6?
No. IPv6 requires an IPv6 address on the instance, an ::/0 route to the internet gateway, and matching IPv6 permissions in the security group and network ACL. IPv4 entries do not authorize IPv6 traffic.
What does a successful netcat test prove?
It proves that a TCP connection to the specified host and port completed from that client at that moment. It does not verify the SSH username, private key, operating-system policy, or authorization.
When should I stop changing AWS networking rules?
Stop when the TCP probe reaches the host or the SSH client advances to key exchange or authentication. At that point, further VPC changes can obscure the real issue; investigate the SSH service, host firewall, username, or key instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
