SSH "Connection timed out": causes and fixes

What "Connection timed out" means

A timeout means your packets got no answer at all — they were dropped somewhere, or sent to an address where nothing exists. That's the key difference from Connection refused (an active "nothing listening here" reply): refused proves the machine is reachable; timed out proves nothing is. The causes are all variations of "your traffic can't reach the box": wrong IP, host down, a firewall silently dropping, or — the number one mobile case — trying to reach a private address from outside its network.

The causes, most likely first

1 — The classic: "works at home, times out outside"

Addresses like 192.168.x.x, 10.x.x.x, or raspberrypi.local only exist inside your home network. From cellular or any other network, packets to them go nowhere — a guaranteed timeout. The clean fix is not port forwarding (exposing SSH to the internet); it's a mesh VPN: put the box and your phone on Tailscale and connect to its stable private 100.x address from anywhere. TermAI has Tailscale built in, so the phone side needs no extra app.

2 — Verify the IP and that the host is up

On the same network, ping the address. No reply usually means a wrong/changed IP or a powered-off box — check the router's device list, or on the box run hostname -I. Remember sleep policies: a Mac with the lid closed and "Prevent sleep" off won't answer; a Pi with a flaky power supply may have died quietly.

3 — Firewalls that drop instead of reject

Cloud providers' security groups drop disallowed traffic, which looks like a timeout (not a refusal). If a VPS times out on 22, check the provider dashboard's firewall rules before anything else. On the box itself, sudo ufw status — a DROP policy without an SSH allow rule behaves the same.

4 — The network you're on blocks it

Some corporate, school, and hotel networks block outbound port 22. Test by switching to cellular: if it suddenly works, the network was the problem. Long-term options: run SSH on 443 on a server you control, or — cleaner — Tailscale, which traverses these networks without opening ports.

A 60-second diagnosis

ping HOST              # any reply? host exists and is reachable
nc -vz HOST 22         # port answers? ("succeeded" / "refused" / hangs = dropped)
# hangs on every port → routing/firewall; refused on 22 → see the refused guide

From a phone, run these from any box you can reach on that network — or ask TermAI's assistant for the exact probe command and run it there.

FAQ

Why does SSH work at home but time out on mobile data?
You're connecting to a private LAN address that doesn't exist outside your home network. Use Tailscale (built into TermAI) to give the box a stable address reachable from anywhere.

What's the difference between timed out and refused?
Timed out = no answer at all (unreachable, dropped, or wrong address). Refused = the machine answered but nothing listens on that port.

Why does my VPS time out on port 22?
Most often the provider's security group / cloud firewall has no SSH rule — that traffic is silently dropped before the OS sees it.

Quick Facts

• Meaning: packets got no reply — unreachable host, dropped traffic, or wrong address
• #1 mobile cause: private LAN IP from outside → use Tailscale, not port forwarding
• Cloud cause: security group DROP (check the provider dashboard)
• Diagnose: ping + nc -vz host 22 — hang=dropped, refused=see refused guide