"Connection timed out" is the most common message people see when starting with EC2, and it is maddening because it gives no hint about what is wrong. The fix is to stop guessing and walk the network path from the outside in. Every hop below must allow the traffic; the first one that does not is your culprit.
First: timeout or refused?
- Connection timed out: packets are dropped somewhere on the way (routing or firewalls), or the instance is down.
- Connection refused: packets arrive, but nothing listens on that port, or the OS firewall actively rejects. Skip to the OS and service checks.
- Permission denied (publickey) for SSH: networking works; the key or username is wrong.
The checklist
1. Is the instance running and healthy?
Check the instance state and both status checks (system and instance). A failed instance status check often means the OS did not boot (bad fstab entry, full disk). The system log and instance screenshot in the console show what the boot is doing.
2. Does it have a public address?
For access from the internet, the instance needs a public IPv4 address or Elastic IP. Instances in a subnet with auto-assign public IP turned off have none. Also note the public IP changes when you stop and start the instance, unless it is an Elastic IP.
3. Does the subnet route to an internet gateway?
Open the subnet's route table. A public subnet needs 0.0.0.0/0 → igw-…, and the internet gateway must be attached to the VPC. A route to a NAT gateway does not allow inbound connections.
4. Does the security group allow the port from your IP?
For SSH, inbound TCP 22 from your current public IP (search "what is my IP"; it changes on home networks and VPNs). For a website, TCP 80/443 from 0.0.0.0/0. Make sure the rule is on the security group actually attached to the instance's network interface.
5. Do the network ACLs allow it, both ways?
NACLs are stateless: inbound must allow your port, and outbound must allow the ephemeral return ports (1024–65535). A NACL with only inbound rules produces exactly this timeout. See Security Groups vs Network ACLs.
6. Is the OS firewall in the way?
Some AMIs enable firewalld, ufw or Windows Firewall rules. Use Session Manager or EC2 Serial Console to get in without the network path and check.
7. Is the service listening on the right address and port?
From inside the instance:
sudo ss -tlnp # what is listening, on which address
curl -I http://localhost # does the app answer locally?An app listening on 127.0.0.1:3000 is unreachable from outside even with every firewall open; it must listen on 0.0.0.0 (and the security group must open port 3000, not 80, unless a reverse proxy forwards).
8. Is something between you and AWS blocking it?
Corporate networks and some public Wi-Fi block outbound port 22. Try from another network, or use Session Manager instead of SSH entirely.
Tools that find the break for you
- VPC Reachability Analyzer: define a source (internet gateway) and destination (the instance's network interface and port). It analyzes the configuration and names the exact blocking component: route table, security group or NACL.
- VPC Flow Logs: records with
REJECTshow which traffic was dropped at the interface; ACCEPT inbound with no matching outbound points to a NACL or OS issue. - EC2 Instance Connect and Session Manager: alternative ways in that bypass your SSH setup.
Behind a load balancer?
If users reach the site through an ALB, check the load balancer's security group (inbound from the internet), the instance's security group (inbound from the ALB's security group on the app port), target health in the target group, and that the health check path returns 200.
Practice on broken instances
Cloud Arena's break-fix labs give you a broken environment in a real AWS account and check when you have fixed it: Bakery Web Server Unreachable, Order Kiosk Has No Public Address, Public Subnet with No Way Out and Website Down After Overnight Maintenance.
FAQ
Why does SSH work from home but not from the office?
Your public IP differs, so your security group rule no longer matches, or the office network blocks port 22.
I stopped and started the instance and now it times out.
The public IP changed. Use the new address, or attach an Elastic IP.