EC2 SSH "Operation timed out" from cmux and plain ssh: security group pinned to an old public IP

Symptom: cmux ssh <host> could not connect; plain ssh also gave connect to host ... port 22: Operation timed out (not refused, not auth failure). Instance was running with an Elastic IP.

Cause: the security group allowed SSH only from the laptop public IP /32 at creation time. Moving networks (campus wifi vs another network) changed the public IP, so the SG silently dropped packets. A timeout (vs refused) on port 22 is the tell.

Check: curl -s https://checkip.amazonaws.com vs aws ec2 describe-security-groups --group-ids <sg> --query SecurityGroups[0].IpPermissions[].IpRanges[].CidrIp. Fix: aws ec2 authorize-security-group-ingress --group-id <sg> --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges=[{CidrIp=<ip>/32}]. Long transfers survived because they ran in tmux on the VM.

Also: an rsync dry-run verify (-aHRn --itemize-changes) showing >f..t...... means only mtimes differ, not content.