How to fix ssh: connect to host github.com port 22: Connection timed out (firewall) in Git

GitBEGINNERMEDIUMUpdated Dec 6, 2025· 355 views

When a firewall blocks SSH port 22, Git operations fail with a connection timeout. This is common in corporate networks and institutions. The fix is to use GitHub's SSH server on port 443 or switch to HTTPS authentication.

Quick fix

Fixes ssh: connect to host github.com port 22: Connection timed out (firewall)

# Test standard SSH connection
ssh -vT git@github.com

Verify the firewall is blocking port 22
Test SSH over port 443
Configure SSH to always use port 443 for GitHub
Alternative: Use Git URL rewriting

git — error

$# Test standard SSH connection
ssh -vT git@github.com
ssh: connect to host github.com port 22: Connection timed out (firewall)

What this error means

The "ssh: connect to host github.com port 22: Connection timed out" error with a firewall indication means that a network firewall is actively blocking your SSH traffic on the standard port 22. Unlike general connectivity issues, this error specifically points to firewall interference - either from your corporate network, ISP, school, or local security software. Firewalls block port 22 because SSH can be used for tunneling arbitrary traffic, which security administrators want to prevent. However, this also breaks legitimate Git workflows over SSH. The connection "times out" because blocked packets are silently dropped (not rejected), leaving your SSH client waiting indefinitely for a response that never comes. GitHub recognized this common problem and provides an alternative SSH endpoint on port 443, which is the standard HTTPS port. Since blocking port 443 would break all secure web browsing, this port is almost never restricted, making it an effective workaround for firewall-blocked SSH.

Typical symptoms

Git push, pull, clone, and fetch commands hang for 30-60 seconds before failing
Error message explicitly mentions 'Connection timed out' on port 22
SSH works fine from home but fails at office, school, or public WiFi
Running 'ssh -T git@github.com' times out instead of authenticating
HTTPS Git operations work normally while SSH operations fail
VPN connection resolves the issue (indicating network-level blocking)
Error appears after moving to a new network environment
CI/CD pipelines fail in restricted network environments

Common causes

Corporate firewall blocking outbound port 22 traffic (most common)
ISP blocking SSH port for residential or public connections
Educational institution network restricting non-web traffic
Public WiFi hotspot with restrictive port policies
VPN or proxy configuration routing through a restricted gateway
Local antivirus or security software blocking SSH connections
Cloud instance security groups not allowing outbound SSH

How to fix "ssh: connect to host github.com port 22: Connection timed out (firewall)"

1Verify the firewall is blocking port 22

First, confirm that the issue is specifically a firewall blocking port 22:

bash

# Test standard SSH connection
ssh -vT git@github.com

If blocked by a firewall, you'll see the connection attempt hang and eventually fail with "Connection timed out". The verbose output (-v) will show it stuck at "Connecting to github.com port 22".

To confirm HTTPS works (proving it's a port issue, not general connectivity):

bash

curl -I https://github.com

If HTTPS works but SSH doesn't, a firewall is almost certainly blocking port 22.

2Test SSH over port 443

GitHub provides SSH access on port 443, which firewalls typically allow. Test if this works:

bash

ssh -T -p 443 git@ssh.github.com

Expected successful output:

bash

Hi username! You've successfully authenticated, but GitHub does not provide shell access.

If this works, proceed to make this configuration permanent. Note that the hostname is ssh.github.com, not github.com - GitHub runs a separate SSH server for port 443 connections.

3Configure SSH to always use port 443 for GitHub

Add a permanent SSH configuration to route all GitHub connections through port 443:

bash

# Create .ssh directory if it doesn't exist
mkdir -p ~/.ssh

# Create or edit the SSH config file
nano ~/.ssh/config

Add this configuration:

bash

Host github.com
    Hostname ssh.github.com
    Port 443
    User git

Set proper permissions and test:

bash

chmod 600 ~/.ssh/config
ssh -T git@github.com

Your Git commands will now automatically use port 443 without changing any remote URLs.

4Alternative: Use Git URL rewriting

If you prefer not to modify SSH config, configure Git to rewrite URLs globally:

bash

git config --global url."ssh://git@ssh.github.com:443/".insteadOf "git@github.com:"

This automatically converts SSH URLs to use port 443. Verify the configuration:

bash

git config --global --get-regexp url

To remove this configuration later:

bash

git config --global --unset url."ssh://git@ssh.github.com:443/".insteadOf

5Switch to HTTPS as an alternative

If SSH on port 443 is also blocked, switch to HTTPS authentication:

bash

# Check current remote
git remote -v

# Change to HTTPS URL
git remote set-url origin https://github.com/username/repository.git

For authentication, create a Personal Access Token (PAT):
1. Go to GitHub Settings > Developer settings > Personal access tokens
2. Generate a new token with 'repo' scope
3. Use the token as your password when prompted

To avoid entering credentials repeatedly:

bash

# Cache credentials for 1 hour
git config --global credential.helper 'cache --timeout=3600'

# Or store permanently (less secure)
git config --global credential.helper store

6Check and configure local firewall exceptions

Your local firewall might also be blocking SSH. Add exceptions if needed:

Windows Defender Firewall:
1. Open Windows Security > Firewall & network protection
2. Click "Allow an app through firewall"
3. Add your SSH client (Git Bash, OpenSSH) for outbound connections

Linux (UFW):

bash

# Allow outbound SSH
sudo ufw allow out 22/tcp
sudo ufw allow out 443/tcp

# Verify rules
sudo ufw status

macOS:

bash

# Check firewall status
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

# Add SSH exception if needed
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/bin/ssh

7Request firewall exception from IT

If you're in a corporate environment, consider requesting a firewall exception:

1. Document the business need for SSH access to GitHub
2. Request that IT either:
- Allow outbound connections to github.com on port 22
- Whitelist SSH traffic to GitHub's IP ranges
- Allow port 443 to ssh.github.com

GitHub's IP ranges are published at: https://api.github.com/meta

For many organizations, explaining that port 443 SSH is a secure alternative that doesn't require opening port 22 can help get approval more easily.

Advanced notes

### Why Firewalls Block Port 22

SSH on port 22 is frequently blocked because:
1. SSH tunneling can bypass content filters and security monitoring
2. It can be used to exfiltrate data without inspection
3. Compromised machines could establish reverse SSH shells

Port 443 is allowed because blocking it would break all HTTPS web traffic. GitHub's SSH-over-443 solution exploits this by running an SSH server on a port that firewalls must allow.

### Deep Packet Inspection (DPI) Considerations

Some sophisticated firewalls use Deep Packet Inspection to detect SSH protocol even on port 443. If SSH over 443 still fails:

- The firewall may be detecting and blocking SSH protocol signatures
- Try using HTTPS with a Personal Access Token instead
- Consider asking IT about approved Git access methods

### SSH Config for Multiple Hosts

If you need port 443 for multiple Git hosts:

bash

# GitHub
Host github.com
    Hostname ssh.github.com
    Port 443
    User git

# GitLab also offers SSH over port 443
Host gitlab.com
    Hostname altssh.gitlab.com
    Port 443
    User git
    PreferredAuthentications publickey

# Generic fallback settings
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    ConnectTimeout 30

### Proxy Through SSH Over HTTPS

If you must use a corporate proxy, combine SSH with a proxy command:

bash

Host github.com
    Hostname ssh.github.com
    Port 443
    User git
    ProxyCommand connect -H proxy.corporate.com:8080 %h %p

Requires the connect-proxy package on Linux or connect utility.

### CI/CD Pipeline Configuration

For GitHub Actions or other CI systems behind firewalls:

yaml

- name: Configure SSH for restricted network
  run: |
    mkdir -p ~/.ssh
    cat >> ~/.ssh/config << EOF
    Host github.com
        Hostname ssh.github.com
        Port 443
        User git
    EOF
    chmod 600 ~/.ssh/config

### Debugging Connection Issues

For detailed diagnostics:

bash

# Maximum verbosity
ssh -vvvT -p 443 git@ssh.github.com

# Check what IP you're connecting to
nslookup ssh.github.com

# Test TCP connectivity directly
nc -zv ssh.github.com 443

### GitHub Enterprise Limitation

Note: SSH over port 443 is only available for github.com. GitHub Enterprise Server and GitHub Enterprise Cloud with data residency do not support this feature - contact your GitHub Enterprise administrator for alternative solutions.

Frequently asked questions

What does "ssh: connect to host github.com port 22: Connection timed out (firewal" mean?: com port 22: Connection timed out" error with a firewall indication means that a network firewall is actively blocking your SSH traffic on the standard port 22. Unlike general connectivity issues, this error specifically points to firewall interference - either from your corporate network, ISP, school, or local security software. Firewalls block port 22 because SSH can be used for tunneling arbitrary traffic, which security administrators want to prevent.
How do I fix "ssh: connect to host github.com port 22: Connection timed out (firewal"?: When a firewall blocks SSH port 22, Git operations fail with a connection timeout. This is common in corporate networks and institutions. The fix is to use GitHub's SSH server on port 443 or switch to HTTPS authentication.
What causes "ssh: connect to host github.com port 22: Connection timed out (firewal"?: Corporate firewall blocking outbound port 22 traffic (most common) ISP blocking SSH port for residential or public connections Educational institution network restricting non-web traffic
Is the "ssh: connect to host github.com port 22: Connection timed out (firewal" error serious?: It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading

📚Git Official Documentation
📖
Using SSH over the HTTPS port - GitHub Docs(Official Docs)
💬
How to fix 'ssh: connect to host github.com port 22: Connection timed out' - Stack Overflow(Stack Overflow)
🐙
ssh: connect to host ssh.github.com port 22: Operation timed out - GitHub Community(GitHub)
💬
Solution for GitHub SSH Connection Timed Out - GitHub Gist(Stack Overflow)
💬
Github SSH via public WIFI port 22 blocked - Stack Overflow(Stack Overflow)
📝
GitHub SSH Access: Bypassing Firewalls with Port 443

How to fix ssh: connect to host github.com port 22: Connection timed out (firewall) in Git

Quick fix

What this error means

Typical symptoms

Common causes

How to fix "ssh: connect to host github.com port 22: Connection timed out (firewall)"

Advanced notes

Frequently asked questions

Related errors

Official resources & further reading