AWS EC2 Support
EC2 SSH connection timed out: trace the path and restore access.
A timeout means packets never get an answer, which is a different problem from connection refused or permission denied. We walk the network path from your machine to the instance, then the instance itself, and fix the first broken hop.
When You Need This
The situations where this work pays for itself.
Signs it is time
- ssh reports Connection timed out or RDP cannot connect
- Access broke after a security group, route table or NACL change
- A new instance in a custom VPC is unreachable from the internet
- Your office or home IP address changed
- You want a way in that does not need port 22 open to the world
What you get
- Identified root cause with the exact failing hop
- Corrected security group, route and NACL rules
- Session Manager access with logging to CloudWatch or S3
- A least-privilege network access standard for your team
How we do it
A clear, safe process you can follow along with.
1. Read the error precisely
Connection timed out means no reply, usually a security group, NACL, route or public IP issue. Connection refused means the host answered but nothing listens on the port. Permission denied (publickey) means the network is fine and the key or username is wrong.
2. Check the instance has a reachable address
We confirm the instance has a public IPv4 or Elastic IP, or that you are connecting over VPN, Direct Connect or a bastion. A stopped and started instance without an Elastic IP gets a new public address, a common cause of sudden failures.
3. Check the security group
We verify an inbound rule for TCP 22 (or 3389) from your current public IP, not the old one, and that you are looking at the security group actually attached to the instance network interface.
4. Check the subnet route table and network ACL
A public subnet needs a 0.0.0.0/0 route to an internet gateway. Network ACLs are stateless, so they must allow the inbound port and the ephemeral return ports. We check both directions.
5. Run VPC Reachability Analyzer
We create a path from the internet gateway to the instance network interface on the port. Reachability Analyzer names the exact component that blocks the traffic, which saves guessing across security groups, ACLs and routes.
6. Check the instance itself
If the network path is clean, we check the status checks, the console output and whether sshd or the RDP service is running, plus the OS firewall (iptables, firewalld, Windows Firewall) and whether the instance is out of memory or disk.
7. Switch to access that avoids the problem
We set up AWS Systems Manager Session Manager or EC2 Instance Connect Endpoint so admins reach instances over IAM-controlled sessions with no inbound port, then remove the open port 22 rule.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Opening port 22 to 0.0.0.0/0 to see if it helps
It may fix the symptom, but it exposes the instance to constant scanning. We scope to known ranges or remove it with Session Manager.
Editing the wrong security group
Instances can have several groups and network interfaces. We check the one on the interface being used.
Forgetting NACLs are stateless
A rule that allows port 22 in but blocks ephemeral ports out looks right but still times out.
Using the wrong username
ec2-user, ubuntu, admin and others depend on the AMI. This produces a permission error, not a timeout.
Frequently Asked Questions
Why does SSH to my EC2 instance time out?
The most common causes are a security group without your current IP, no public IP or internet route, a network ACL blocking return traffic, or the OS firewall. Reachability Analyzer shows which one applies.
How do I get into an instance if I lost the SSH key?
If Systems Manager is set up, use Session Manager. Otherwise we stop the instance, mount its root volume on a rescue instance, add a new public key to authorized_keys and reattach. The same approach works for a broken sshd config.
Is Session Manager a safe replacement for SSH?
For most teams yes. Access is controlled by IAM, needs no inbound ports, and sessions can be logged. The instance needs the SSM Agent and an instance profile with the right permissions.
Want Help With EC2 SSH connection timed out: trace the path and restore access?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required