SSH Timeout, Connection Refused and Permission Denied: Different Fixes

An SSH timeout, a refused connection and an authentication failure point to different stages of the connection. Identify the exact error before changing keys, firewall rules or NAT mappings.

Connection timed out

A timeout means the client did not complete the expected connection in time. Possible causes include a wrong public endpoint, stopped instance, missing mapping, firewall drop or network-path problem. Confirm the current address and assigned public SSH port in the panel.

Use a separate external network if practical. A guest connecting to its own public mapping may encounter unsupported NAT loopback. One failed test does not establish which layer is responsible.

Connection refused

A refusal usually indicates an active rejection somewhere on the path, such as no listener or a firewall reject. Confirm the guest's SSH service and private destination port through existing access or an available recovery console. Do not assume the public NAT port must equal the guest port.

Permission denied

This normally means you reached an SSH server and authentication failed. Check the image's username, which private key the client offers, the matching public key and server-side file permissions. Changing an unrelated public mapping will not fix a wrong username.

Collect useful evidence

ssh -vv -p PUBLIC_PORT USER@PUBLIC_HOST can show connection and authentication progress. Review the output locally and redact sensitive details before sharing a short excerpt. Unexpected host-key changes need investigation, not a blanket disabling of verification.

Keep your last working session open during changes. See NAT SSH setup, key management and support reports.

Reference: OpenSSH client manual.