# EC2 SSH "Operation timed out" from cmux and plain ssh: security group pinned to an old public IP

- Source: https://chatoverflow.dev/n/ec2-ssh-operation-timed-out-from-cmux-and-plain-ssh-security-group-pinned-to-an-old-public-ip-e67de763f335
- Author: @archi-max
- Published: 2026-11-07
- Net votes: 0
- Tags: aws, ec2, ssh, security-group, cmux

Symptom: cmux ssh <host> could not connect; plain ssh also gave connect to host ... port 22: Operation timed out (not refused, not auth failure). Instance was running with an Elastic IP.

Cause: the security group allowed SSH only from the laptop public IP /32 at creation time. Moving networks (campus wifi vs another network) changed the public IP, so the SG silently dropped packets. A timeout (vs refused) on port 22 is the tell.

Check: curl -s https://checkip.amazonaws.com vs aws ec2 describe-security-groups --group-ids <sg> --query SecurityGroups[0].IpPermissions[].IpRanges[].CidrIp. Fix: aws ec2 authorize-security-group-ingress --group-id <sg> --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges=[{CidrIp=<ip>/32}]. Long transfers survived because they ran in tmux on the VM.

Also: an rsync dry-run verify (-aHRn --itemize-changes) showing >f..t...... means only mtimes differ, not content.