How to fix ssh: connect to host hostname port 22: Connection timed out in SSH

First, check if you can reach the server at all using ping or a connectivity test. If the server is completely unreachable, networking issues are the root cause.

ping -c 4 hostname.example.com
# or
ping -c 4 192.168.1.100

If ping fails, the server is offline or your network can't reach it. If ping succeeds, proceed to the next step.

Use telnet or netcat to test if port 22 is accepting connections. This tells you if the server is listening on port 22.

# Using telnet (may not be installed)
telnet hostname.example.com 22

# Using netcat (better, more reliable)
nc -zv hostname.example.com 22

# Using timeout to prevent hanging
timeout 5 telnet hostname.example.com 22

If you get 'Connection refused', the port is closed. If you get 'Connection timed out', the firewall is blocking it. If you get a response with SSH version info, port 22 is open and listening.

Connect to the server using a different method (console, VNC, KVM) and check that sshd is running:

# Check SSH daemon status
sudo systemctl status sshd

# If not running, start it
sudo systemctl start sshd

# Enable it to start on boot
sudo systemctl enable sshd

On older systems without systemd:

sudo service ssh status
sudo service ssh start

Verify SSH is listening on port 22:

sudo ss -tlnp | grep ssh
# or
sudo netstat -tlnp | grep ssh

If sshd is running but port 22 is blocked, check the server's firewall:

# For UFW (Ubuntu/Debian)
sudo ufw status
sudo ufw allow 22/tcp

# For firewalld (CentOS/RHEL)
sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

# For iptables (check rules)
sudo iptables -L -n | grep 22

# If iptables is blocking, allow SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables-save  # Make changes persistent

If your server is on a cloud provider, ensure the security group allows inbound SSH:

AWS:
- Security Group > Inbound Rules > Add rule
- Protocol: TCP, Port: 22, Source: Your IP or 0.0.0.0/0 (less secure)

Azure:
- Network security group > Inbound security rules
- Add rule allowing TCP port 22 from your IP

GCP:
- VPC network > Firewall rules
- Create rule allowing tcp:22 traffic

Also check Network ACLs (if used) - they can block traffic before security groups.

If the server is configured to use a non-standard SSH port, you must specify it in your command:

# Default port 22
ssh [email protected]

# Custom port (e.g., 2222)
ssh -p 2222 [email protected]

Check the server's SSH configuration to find the actual port:

grep '^Port' /etc/ssh/sshd_config

Default is 22 if this line is commented out.

Use SSH's verbose flags to see exactly where the connection is failing:

# Single verbose
ssh -v [email protected]

# Double verbose (more details)
ssh -vv [email protected]

# Triple verbose (maximum details)
ssh -vvv [email protected]

Look for the line where it gets stuck - usually something like:
- 'Trying X.X.X.X...' means it's trying to connect
- No response after this = firewall blocking the connection
- 'Timeout' message = connection timed out (firewall)
- 'Connection refused' = port is closed on server

Some ISPs or corporate networks block port 22 for security. Test this:

# Try using a port known to be open (like 443 for HTTPS)
# Ask your server admin to listen on this alternate port
ssh -p 443 [email protected]

# Or test with a public SSH server (if allowed)
ssh -p 22 [email protected]  # GitHub allows SSH

If alternate ports work but 22 doesn't, your network provider may be blocking port 22. Solutions:
- Use a VPN to bypass the block
- Ask your IT/ISP to unblock port 22
- Configure SSH on an alternate port (443, 8022, etc.) with server admin help

If connections work but are slow, increase the client-side timeout:

# Increase timeout to 30 seconds (default is ~20)
ssh -o ConnectTimeout=30 [email protected]

Or add to your ~/.ssh/config file:

Host *
    ConnectTimeout 30
    ServerAliveInterval 60
    ServerAliveCountMax 3

These settings prevent idle connections from timing out and increase the initial connection timeout for slow networks.