SSH connection timed out: 5-step diagnosis with nc and ufw

Q: How do I check if port 22 is open on a server?

Port 22 on a server can be checked with nc -zv -w 5 host 22 , which attempts the TCP connection without authenticating. If it reports succeeded or open, the port is reachable and the problem is in SSH; if it waits until the limit, the network or a firewall is dropping traffic.

SSH connection timed out means the client sent its request to TCP port 22 and nothing answered before the wait expired. The usual culprits are a firewall dropping packets (ufw or a cloud security group), a port other than 22, or an IP address that has changed. You can isolate it in minutes with nc -zv host 22.

SSH connection timed out vs connection refused: what each error tells you

Connection refused shows up when the packet reaches the server and nothing listens on that port: the host replies with an immediate rejection. Connection timed out is silence: the packet gets lost on the way or a firewall drops it without replying. Telling the two apart cuts the troubleshooting in half.

Connection refused: sshd stopped, listening on another port, or a firewall set to reject instead of drop.
Connection timed out: a dropping firewall, a security group with no inbound rule, the wrong IP, a powered-off machine or a network blocking outbound port 22.
No route to host: a routing problem or a host unreachable on the local network.

5 steps to diagnose an SSH connection timed out error

Work from the quickest check to the one that forces you into your provider's console:

Confirm the address. Resolve the name with dig +short host and compare it with the IP shown in your provider's dashboard.
Test the port with nc. nc -zv host 22 tells you whether anything listens, without touching SSH authentication.
Switch networks. If it connects over mobile data but not on wifi, that network blocks outbound port 22.
Check the host firewall. From the provider's web console, sudo ufw status verbose shows whether 22/tcp is allowed.
Check the security group. The inbound rule must accept TCP 22 from your current IP, not the one you had yesterday.

nc -zv host 22: test the SSH port without authenticating

nc with -z opens a TCP connection to the given port and closes it without sending data; -v reports the result and -w caps the wait in seconds. It is the cleanest way to separate a network problem from an SSH problem.

nc -zv -w 5 server.example.com 22
nc -zv -w 5 203.0.113.10 2222
ssh -v -o ConnectTimeout=10 -p 22 [email protected]

If nc prints succeeded or open (depending on the variant installed), the port is reachable and the fault lies in SSH: user, keys or configuration. If it hangs until the timeout, the block is in the network. With ssh -v you will see the line Connecting to ... port 22; if Connection established never appears, there is no point checking keys or permissions. The exact options are in the nc manual page.

OpenSSH listens on TCP port 22 by default. If someone changed Port in sshd_config, connecting to 22 returns a timeout or a refusal depending on what the firewall does with that port; use -p or the Port directive in ~/.ssh/config.

ufw status and security groups: the two firewalls that block SSH

A cloud server usually sits behind two filters: the OS firewall, such as ufw on Ubuntu, and the provider's security group or network firewall. Either one dropping the packet is enough to make SSH time out. Check the first from the provider's web console, not from another SSH session that depends on the same rule:

sudo ufw status verbose
sudo ufw allow 22/tcp
sudo ufw allow 60000:61000/udp
sudo ss -tlnp | grep sshd

ufw status verbose shows the default incoming policy and the active rules; if incoming is deny and there is no rule for 22/tcp, that is your timeout. ss -tlnp confirms which address and port sshd listens on. The UDP rule is only needed for Mosh, which uses ports 60000-61000 by default.

In the security group, review the inbound rules: there must be one for TCP 22 whose source includes your current public IP. Restricting the source to a single address is good practice, and it is also the most common reason for a timeout when you connect from a different network.

Changed IP: when the SSH server or your phone has a new address

A changed IP produces a connection timed out error identical to a firewall block, and the change can happen at either end.

Server side: an instance stopped and started without a static IP may come back with a different address. Check the DNS record with dig +short server.example.com and the HostName in your ~/.ssh/config.
Client side: if the security group only allows the office IP, on mobile data or hotel wifi you arrive from another address and the packet is dropped.

For machines without a public IP or exposed ports, a private mesh network stops you chasing addresses: the server is reached through its mesh IP without opening port 22 to the internet. Two options are the Prialo private mesh network and Tailscale.

SSH connection timed out on iOS and Android: what differs from desktop

On a phone the network changes constantly, so changed IPs and networks blocking port 22 show up far more often than on a wired laptop.

What you check	Desktop (Linux/macOS)	iOS/Android
Testing the port with nc	nc -zv in the local terminal	nc -zv from another server you are logged into
How often the IP changes	Rarely: fixed home or office network	Often: moving from wifi to data changes the public IP
Outbound port 22 blocked	Rare on your own networks	Common on guest, hotel and airport wifi
Session when the network changes	SSH drops; tmux keeps your work	Mosh keeps it open; tmux keeps your work
Ctrl, Esc and arrow keys	Physical keyboard	Depends on the app; termi1 includes them

In termi1, the built-in keyboard has Esc, Ctrl, Tab and arrows, so killing a hung nc with Ctrl+C or recalling the previous command takes no gymnastics. Mosh keeps the session alive when you move from wifi to data, but it starts mosh-server over an initial SSH connection: if port 22 times out, Mosh cannot get in either. The AI can type a command such as sudo ufw status verbose into the prompt from a dictated sentence, without pressing Enter; on connections tagged as production, Production Guard holds back changes like ufw allow before they reach the prompt. You can try it with the termi1 terminal for iOS.

Frequently asked questions

What does connection timed out mean in SSH?

Connection timed out in SSH means the client tried to open a TCP connection to the server and got no reply before the wait expired. The usual causes are a firewall dropping packets, a security group with no rule for port 22, the wrong IP address or a server that is switched off.

How do I check if port 22 is open on a server?

Port 22 on a server can be checked with nc -zv -w 5 host 22, which attempts the TCP connection without authenticating. If it reports succeeded or open, the port is reachable and the problem is in SSH; if it waits until the limit, the network or a firewall is dropping traffic.

Why does SSH work on mobile data but time out on wifi?

SSH works on mobile data but times out on wifi when that wifi network blocks outbound port 22, which is common on guest and corporate networks. The reverse also happens when the security group only allows the wifi's public IP and not the address assigned by your mobile carrier.

Does Mosh need ports open besides 22?

Mosh needs TCP port 22 for the initial SSH connection that starts mosh-server, plus UDP ports 60000-61000 by default. If the firewall or security group only allows port 22, the SSH connection succeeds but the Mosh session never manages to establish itself.