.pem<\/code>)<\/li>\n\n\n\n- Access to the AWS Management Console<\/li>\n\n\n\n
- Basic knowledge of Linux and SSH<\/li>\n<\/ul>\n\n\n\n
Implementation<\/h2>\n\n\n\nStep 1: Check the EC2 Instance Status<\/h3>\n\n\n\n
First, log in to the AWS Management Console<\/strong> and navigate to:<\/p>\n\n\n\nEC2 \u2192 Instances<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-14-at-3.23.34-PM.png\")
<\/a><\/figure>\n\n\n\nCheck the following:<\/p>\n\n\n\n
\n- Instance state should be Running<\/strong><\/li>\n\n\n\n
- Status checks should show 2\/2 checks passed<\/strong><\/li>\n\n\n\n
- Verify the Public IPv4 address<\/strong><\/li>\n\n\n\n
- Verify the Public IPv4 DNS<\/strong><\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-14-at-3.28.07-PM.png\")
<\/a><\/figure>\n\n\n\nIf the instance is stopped, start the instance and wait for the status checks to complete.<\/p>\n\n\n\n
Step 2: Check the Security Group<\/h3>\n\n\n\n
One of the most common causes of SSH connection failure is a missing or incorrect Security Group rule.<\/p>\n\n\n\n
Go to:<\/p>\n\n\n\n
EC2 \u2192 Instances \u2192 Select Instance \u2192 Security<\/strong><\/p>\n\n\n\nOpen the associated Security Group and check the inbound rules.<\/p>\n\n\n\n
Make sure TCP port 22<\/code> is allowed from your IP address.<\/p>\n\n\n\nExample:<\/p>\n\n\n\n
Type: SSH\nProtocol: TCP\nPort: 22\nSource: <Your-Public-IP>\/32<\/pre>\n\n\n\nFor example:<\/p>\n\n\n\n
SSH TCP 22 203.0.113.10\/32<\/pre>\n\n\n\nFor testing purposes, you may temporarily allow SSH from a wider source, but restricting SSH access to your IP address is recommended.<\/p>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-14-at-3.29.00-PM-1024x116.png\")
<\/a><\/figure>\n\n\n\nStep 3: Check the Network ACL<\/h3>\n\n\n\n
If the Security Group is configured correctly but SSH is still not working, check the Network ACL<\/strong> associated with the subnet.<\/p>\n\n\n\nGo to:<\/p>\n\n\n\n
VPC \u2192 Subnets \u2192 Select Subnet \u2192 Network ACL<\/strong><\/p>\n\n\n\nMake sure the Network ACL allows the required traffic.<\/p>\n\n\n\n
For SSH, verify that:<\/p>\n\n\n\n
\n- Inbound TCP port
22<\/code> is allowed.<\/li>\n\n\n\n- Return traffic is allowed through the appropriate ephemeral ports.<\/li>\n\n\n\n
- Outbound traffic is not being blocked.<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-14-at-3.30.36-PM-1024x58.png\")
<\/a><\/figure>\n\n\n\nStep 4: Check the Route Table<\/h3>\n\n\n\n
The EC2 instance must have a valid network route to the internet if you are connecting through its public IP.<\/p>\n\n\n\n
Go to:<\/p>\n\n\n\n
VPC \u2192 Route Tables<\/strong><\/p>\n\n\n\nCheck the route table associated with the subnet.<\/p>\n\n\n\n
A typical public subnet should have a route similar to:<\/p>\n\n\n\n
Destination Target\n0.0.0.0\/0 Internet Gateway<\/pre>\n\n\n\nIf there is no route to an Internet Gateway, the instance may not be reachable directly from the internet.<\/p>\n\n\n\n
Step 5: Check the Instance Public IP<\/h3>\n\n\n\n
Verify that the EC2 instance has a public IPv4 address.<\/p>\n\n\n\n
From the AWS Console:<\/p>\n\n\n\n
EC2 \u2192 Instances \u2192 Select Instance<\/strong><\/p>\n\n\n\nCheck:<\/p>\n\n\n\n
Public IPv4 address<\/pre>\n\n\n\nIf the instance does not have a public IP address, direct SSH access from the internet will not work.<\/p>\n\n\n\n
In a private subnet, you normally need another access method, such as a bastion host, VPN, or AWS Systems Manager Session Manager.<\/p>\n\n\n\n
Step 6: Check the SSH Key Permissions<\/h3>\n\n\n\n
When using a .pem<\/code> key from Linux or macOS, make sure the private key has the correct permissions.<\/p>\n\n\n\nRun:<\/p>\n\n\n\n
chmod 400 your-key.pem<\/pre>\n\n\n\nThen connect using:<\/p>\n\n\n\n
ssh -i your-key.pem ubuntu@<EC2-Public-IP><\/pre>\n\n\n\nFor an Amazon Linux instance, the default user may be:<\/p>\n\n\n\n
ssh -i your-key.pem ec2-user@<EC2-Public-IP><\/pre>\n\n\n\nThe username depends on the operating system image used to launch the EC2 instance.<\/p>\n\n\n\n
Step 7: Test the SSH Port<\/h3>\n\n\n\n
You can check whether port 22<\/code> is reachable from your local system.<\/p>\n\n\n\nUsing nc<\/code>:<\/p>\n\n\n\nnc -vz <EC2-Public-IP> 22<\/pre>\n\n\n\nOr using telnet<\/code>:<\/p>\n\n\n\ntelnet <EC2-Public-IP> 22<\/pre>\n\n\n\nIf the connection is successful, you should see that port 22<\/code> is reachable.<\/p>\n\n\n\nIf the connection times out, check the Security Group, Network ACL, route table, public IP, and firewall configuration.<\/p>\n\n\n\n
Step 8: Check the SSH Service<\/h3>\n\n\n\n
If you have console access to the instance through another method, check whether the SSH service is running.<\/p>\n\n\n\n
For Ubuntu:<\/p>\n\n\n\n
systemctl status ssh<\/pre>\n\n\n\nIf it is not running:<\/p>\n\n\n\n
systemctl start ssh<\/pre>\n\n\n\nEnable it at boot:<\/p>\n\n\n\n
systemctl enable ssh<\/pre>\n\n\n\nFor systems using sshd<\/code>:<\/p>\n\n\n\nsystemctl status sshd<\/pre>\n\n\n\nStep 9: Check the Server Firewall<\/h3>\n\n\n\n
The operating system firewall may also block SSH connections.<\/p>\n\n\n\n
For Ubuntu systems using UFW:<\/p>\n\n\n\n
ufw status<\/pre>\n\n\n\nIf SSH is not allowed, add the SSH rule:<\/p>\n\n\n\n
ufw allow 22\/tcp<\/pre>\n\n\n\nThen check the firewall status again:<\/p>\n\n\n\n
ufw status<\/pre>\n\n\n\nIf you are using another firewall such as iptables<\/code> or firewalld<\/code>, check its rules as well.<\/p>\n\n\n\nStep 10: Use Verbose SSH Output<\/h3>\n\n\n\n
If you are still unable to connect, use SSH verbose mode:<\/p>\n\n\n\n
ssh -vvv -i your-key.pem ubuntu@<EC2-Public-IP><\/pre>\n\n\n\nThe -vvv<\/code> option provides detailed information about the SSH connection.<\/p>\n\n\n\nIt can help identify whether the issue is related to:<\/p>\n\n\n\n
\n- Network connectivity<\/li>\n\n\n\n
- Authentication<\/li>\n\n\n\n
- Private key<\/li>\n\n\n\n
- SSH configuration<\/li>\n\n\n\n
- Host verification<\/li>\n\n\n\n
- Server response<\/li>\n<\/ul>\n\n\n\n
Common SSH Errors<\/h2>\n\n\n\nConnection Timed Out<\/h3>\n\n\n\n
Example:<\/p>\n\n\n\n
ssh: connect to host <IP> port 22: Connection timed out<\/pre>\n\n\n\nCheck:<\/p>\n\n\n\n
\n- Security Group<\/li>\n\n\n\n
- Network ACL<\/li>\n\n\n\n
- Route table<\/li>\n\n\n\n
- Internet Gateway<\/li>\n\n\n\n
- Public IP<\/li>\n\n\n\n
- Server firewall<\/li>\n<\/ul>\n\n\n\n
Connection Refused<\/h3>\n\n\n\n
Example:<\/p>\n\n\n\n
ssh: connect to host <IP> port 22: Connection refused<\/pre>\n\n\n\nThis generally means the server is reachable, but nothing is accepting connections on port 22<\/code>.<\/p>\n\n\n\nCheck the SSH service:<\/p>\n\n\n\n
systemctl status ssh<\/pre>\n\n\n\nAlso verify that SSH is listening:<\/p>\n\n\n\n
ss -lntp | grep :22<\/pre>\n\n\n\nPermission Denied<\/h3>\n\n\n\n
Example:<\/p>\n\n\n\n
Permission denied (publickey).<\/pre>\n\n\n\nCheck:<\/p>\n\n\n\n
\n- SSH username<\/li>\n\n\n\n
.pem<\/code> file<\/li>\n\n\n\n- Private key permissions<\/li>\n\n\n\n
- Correct key pair<\/li>\n\n\n\n
authorized_keys<\/code> on the server<\/li>\n<\/ul>\n\n\n\nMake sure the key permissions are restricted:<\/p>\n\n\n\n
chmod 400 your-key.pem<\/pre>\n\n\n\nVerification<\/h2>\n\n\n\n
After making the required changes, try connecting again:<\/p>\n\n\n\n
ssh -i your-key.pem ubuntu@<EC2-Public-IP><\/pre>\n\n\n\nIf the connection is successful, you should receive the server’s shell prompt.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
ubuntu@ip-10-0-1-10:~$<\/pre>\n\n\n\nYou have successfully connected to the EC2 instance.<\/p>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
SSH connection problems in AWS EC2 can occur at different levels, including AWS networking, Security Groups, Network ACLs, operating system firewalls, SSH configuration, and authentication.<\/p>\n\n\n\n
A systematic approach makes troubleshooting easier:<\/p>\n\n\n\n
\n- Check the EC2 instance status.<\/li>\n\n\n\n
- Verify the Security Group.<\/li>\n\n\n\n
- Check the Network ACL.<\/li>\n\n\n\n
- Verify the route table and Internet Gateway.<\/li>\n\n\n\n
- Check the public IP.<\/li>\n\n\n\n
- Verify the SSH key and username.<\/li>\n\n\n\n
- Check the SSH service.<\/li>\n\n\n\n
- Check the server firewall.<\/li>\n\n\n\n
- Use
ssh -vvv<\/code> for detailed troubleshooting.<\/li>\n<\/ol>\n\n\n\nFollowing these steps can help identify and resolve most common SSH connectivity issues with Linux-based EC2 instances.<\/p>\n\n\n\n
FAQ<\/h2>\n\n\n\n1. Why can’t I connect to my EC2 instance using SSH?<\/h3>\n\n\n\n
The most common reasons are an incorrect Security Group rule, blocked port 22<\/code>, missing public IP, incorrect route table, server firewall, stopped SSH service, or an incorrect SSH key or username.<\/p>\n\n\n\n2. Why am I getting “Connection timed out”?<\/h3>\n\n\n\n
A timeout usually indicates a network connectivity issue. Check the Security Group, Network ACL, route table, Internet Gateway, public IP address, and firewall.<\/p>\n\n\n\n
3. Why am I getting “Connection refused”?<\/h3>\n\n\n\n
This usually means the EC2 instance is reachable, but the SSH service is not accepting connections.<\/p>\n\n\n\n
Related Articles<\/h2>\n\n\n\n
How to Enable Multi-Factor Authentication (MFA) for an AWS IAM User<\/a><\/p>\n\n\n\nHow to Create an AWS EC2 Instance Using Terraform in Ubuntu<\/a><\/p>\n\n\n\n