The message
On macOS:
ssh: connect to host 203.0.113.10 port 22: Operation timed outOn Linux:
ssh: connect to host 203.0.113.10 port 22: Connection timed outYour computer sent a request to open a connection and heard nothing back. SSH never started, so keys and passwords are not involved.
How it differs from Connection refused
We set up each case on a test server, and this is what ssh printed:
| Situation | Message | What it tells you |
|---|---|---|
| Firewall rule set to drop | Connection timed out | Nothing answered |
| Firewall rule set to reject | Connection refused | Something answered no |
| Nothing listening on the port | Connection refused | The machine answered no |
| No route on your own machine | Network is unreachable | Your computer has no path to try |
So look at the network, not at sshd. If you get a refusal, go to Connection refused.
Test quickly
By default you can wait a minute or more for each failure. ConnectTimeout shortens the wait:
ssh -o ConnectTimeout=5 user@203.0.113.10Test only the port, on Linux and then on macOS:
nc -vz -w 5 203.0.113.10 22
nc -vz -G 5 203.0.113.10 22Then check what your config really uses for that name:
ssh -G server | grep -E '^(hostname|port) 'Causes, in order of likelihood
1. A cloud firewall or security group blocks you
Cloud firewalls normally drop what they do not allow, without an answer. Check that an inbound rule allows TCP port 22 from your current public address. A common trap is a rule for one address, after your home or office address has changed.
On AWS, also check the route table of the subnet, the network ACL and whether the instance has a public address, as described in the AWS guide below. Other providers have similar settings under other names.
2. The address is wrong, or the machine is off
dig +short server
ping -c 3 203.0.113.10Compare the result with the address your provider shows, which can change after a stop and start. Ping alone proves little: many servers block it, so no reply does not mean the server is down. Check the state of the machine in the provider's console.
3. A firewall on the server drops it
This shows whether your packets reach the server at all. Run it from the provider's console while you try to connect:
sudo tcpdump -ni any 'tcp port 22'- No packets: they are blocked before the server, so check the cloud firewall, router and route.
- Packets arrive, no reply: the server's own firewall is dropping them, or the reply is going out another way.
List the server's rules with sudo iptables -L INPUT -n or sudo nft list ruleset, and look for a drop rule on port 22.
4. Your own network blocks port 22
Hotels, offices and some public Wi-Fi networks block outgoing SSH. The clue is that it fails on one network and works on another. Try a phone hotspot, or try a different SSH server from the same network.
5. A routing problem
traceroute -n 203.0.113.10Stars on a few hops are normal, because many routers do not reply. Look at where the path stops for good. On Linux, this variant sends TCP to port 22, which goes through more firewalls, and it needs root:
sudo traceroute -n -T -p 22 203.0.113.10If the server has no public address, you cannot reach it directly from outside its private network. Use a VPN or a jump host.
Timed out during the handshake
This message is different:
Connection timed out during banner exchange
Connection to 203.0.113.10 port 22 timed outThe port accepted the connection, but no SSH greeting came back in time. We got it from a test listener that accepted the connection and then stayed silent, with ConnectTimeout set. So the network path is working. Look at the server: an overloaded or stuck machine, a service other than SSH on that port, or a middle box holding the connection. ConnectTimeout covers this stage too, so a very low value can cause the message on a slow server.
Set a timeout in your config
This does not fix anything, but failures come back faster, and scripts do not hang:
Host *
ConnectTimeout 10For other settings worth keeping per host, see these ssh config file examples.
Questions
What is the difference between Connection timed out and Connection refused?
Timed out means nothing answered, usually a firewall that drops packets. Refused means something answered no: nothing listening on that port, or a firewall that rejects.
How do I make SSH fail faster?
Use ssh -o ConnectTimeout=5 user@server, or put ConnectTimeout 10 under Host * in ~/.ssh/config.
Why does SSH time out on AWS?
Most often the security group has no inbound rule for TCP port 22 from your current address. Also check the network ACL, the route table and that the instance has a public address.