Tencent Cloud KYC Linked Accounts How to Fix Tencent Cloud CVM SSH Remote Connection Timeout

If your SSH connection to a Tencent Cloud CVM keeps timing out, the problem is usually not “SSH itself.” In real cases, it is more often one of these: the instance has no usable public IP, port 22 is blocked, the security group allows the wrong source IP, the server’s firewall is rejecting traffic, or the account is still under verification / payment restriction and the resource was never fully activated.

When people search this problem, they are often trying to answer a more practical question: “Is this a server issue, a network issue, or an account issue that I need to fix before I can even log in?” That distinction matters because the solution path is different, and in Tencent Cloud it is common to hit both technical and account-side blockers at the same time.

Start here: the fastest way to tell where the timeout is coming from

1) Check the account side first if the instance is new or recently renewed

A lot of SSH timeout cases are really “purchase and activation” problems. This is especially common for new users who bought a CVM, but the account was still waiting for identity verification, billing approval, or risk review. In those cases, the instance may appear in the console, but the network path is not ready for normal remote access.

What can go wrong before you even reach SSH

• KYC not completed: Some regions or payment methods require identity verification before full resource activation.
• Payment method not accepted: Card authorization failed, prepayment did not clear, or the payment profile is incomplete.
• Risk control review: New accounts, unusual billing patterns, or mismatched identity/payment data can trigger manual checks.
• Renewal overdue: If the instance or bandwidth package expired, public access can stop even if the server data still exists.

In practice, if your CVM was created but SSH times out immediately and the console shows billing warnings, the fix is often not in Linux at all. Check:

1. Account verification status in the Tencent Cloud console
2. Whether the instance is in a normal running state
3. Whether the public IP or EIP is still valid
4. Whether the billing cycle or renewal has expired

If your account was recently registered, do not assume a successful instance creation means everything is fully active. I have seen cases where users paid for CVM, but the account was still under compliance review. The console let them create the instance, but inbound access remained unreliable until verification finished.

Payment method differences that affect activation speed

If you are choosing a payment method for Tencent Cloud International, the main operational question is not just cost. It is whether the method triggers fewer review delays. For urgent production use, I usually recommend the method that has the lowest probability of failing authorization, even if it is not the absolute cheapest.

2) Confirm you are connecting to the right public IP

A surprisingly common issue is simply using the wrong address. Tencent Cloud CVM may have:

• a private VPC IP that cannot be reached directly from the internet
• a public IP assigned at launch
• an EIP bound later for stable external access
• a changed IP after stop/start in certain setups

If you try to SSH to a private IP from your laptop, the connection will time out every time. If you previously connected by public IP and later re-created the instance or re-bound network resources, make sure the target IP in your SSH command is still current.

Example command:

ssh root@your.public.ip

Before troubleshooting deeper, verify in the console:

• Instance status is Running
• The IP you are using is the current public IP or EIP
• The IP belongs to the same region and instance

Tencent Cloud KYC Linked Accounts 3) Security group rules are the most common technical cause

On Tencent Cloud, the security group is often the first real blocker. New users sometimes open the server but forget to open inbound port 22 to their own IP.

What the inbound rule should look like

• Protocol: TCP
• Port: 22
• Source: your current public IP, or a narrowly scoped CIDR block
• Action: allow

A common mistake is allowing only private IP ranges or using the wrong region’s security group. Another is opening port 22 to the wrong source IP because your home network IP changed. If your ISP rotates your residential IP frequently, a rule that worked yesterday may time out today.

How I usually test this in practice

1. Temporarily connect from a mobile hotspot
2. Check the client’s external IP and compare it with the security group rule
3. Test whether port 22 is reachable from outside with a port check tool
4. If needed, add a temporary broader rule for testing, then tighten it again

If you use strict office network policies, the problem may not be Tencent Cloud at all. Corporate firewalls often block outbound SSH traffic. In that case, the connection will hang until timeout even when the server is configured correctly.

4) Check the server firewall and SSH service inside the CVM

If the security group is correct but the timeout remains, the issue may be on the server itself. This often happens after a hardening script, a security update, or a bad firewall rule.

On Linux, verify these items

• sshd is running
• port 22 is listening
• local firewall allows SSH
• root login or the intended user login is permitted

Common checks:

systemctl status sshd
ss -lntp | grep :22
iptables -S
firewall-cmd --list-all
  

If port 22 is not listening, the connection may time out because nothing is answering on that port. If sshd is running but the firewall blocks it, the timeout looks similar from the client side. To the user, both feel like “SSH timeout,” but the fix is different.

Real-world example

A user migrated a WordPress stack to Tencent Cloud CVM and hardened the server with a script that disabled password login, changed SSH to a non-standard port, and enabled a firewall profile. The team kept testing port 22 from their laptop, so every attempt timed out. The instance was healthy; they were just connecting to the wrong port and had not opened the new port in the security group.

This is why the fastest fix is to cross-check the security group, local firewall, and sshd configuration together, not one by one in isolation.

Tencent Cloud KYC Linked Accounts 5) Watch for IP whitelist restrictions and source-based blocking

In many production CVMs, SSH is intentionally limited to a whitelist. This is good practice, but it also causes a lot of confusion when the user travels or changes networks.

If your server only allows a specific office IP, and you try from home, the result is a timeout. If fail2ban, DenyHosts, or a cloud WAF rule has blocked your source IP after repeated attempts, you can see the same symptom.

Typical scenarios

• You changed Wi-Fi networks and your public IP changed
• Your office uses NAT and multiple employees share one outbound IP
• Automated login attempts triggered source blocking
• Tencent Cloud KYC Linked Accounts You are using a VPN that exits from a different country or region

A useful test is to connect from a completely different network. If SSH works on a mobile hotspot but fails on your home line, the server is probably fine. You then need to adjust the whitelist, not rebuild the instance.

6) Region and network route differences matter more than people expect

Tencent Cloud regions do not behave identically from every country or ISP. If you purchased the instance in a distant region, you may see slower handshakes or unstable paths, especially if your ISP has poor international routing.

This does not always cause a timeout by itself, but it can amplify a weak setup:

• small packet loss + strict firewall rules
• high latency + too-short client timeout
• cross-border routing issues + unstable DNS resolution

If the server is in a region far from you, extend the SSH client timeout and test from another network. For business workloads, choose the region based on your users and access location, not just the hourly price.

Cost comparison: cheaper region vs. operational cost

Tencent Cloud KYC Linked Accounts For SSH troubleshooting, the practical value of a stable public IP often outweighs the small additional cost. If you are comparing monthly spend, do not just compare CVM base price. Include EIP, bandwidth, snapshots, and the time cost of repeated remote access failures.

7) If the instance is expired, suspended, or unpaid, SSH may look like a network problem

Renewal issues are easy to miss because the server may still appear in the console for a period of time. Users often discover the issue only after SSH starts timing out.

Things to check in billing

• Tencent Cloud KYC Linked Accounts Account balance or prepaid quota
• Whether auto-renew is enabled
• Whether the CVM or bandwidth package has expired
• Whether there is a payment failure waiting for action

If the account is in arrears, Tencent Cloud may restrict access or pause related resources depending on the service state. In operations terms, you should treat billing health as part of network health.

This is especially important for teams using trial credits or promotional funding. When credits run out, the failure often looks like a timeout, not a billing issue.

8) New account onboarding: avoid buying the wrong way if you need SSH today

If you are buying Tencent Cloud CVM for immediate remote access, the smoothest path is usually:

1. Complete account registration with accurate identity details
2. Finish KYC before buying production resources
3. Use a payment method that passes authorization reliably
4. Choose a region close to your access location
5. Attach an EIP or confirm a public IP at creation
6. Create the security group rule for port 22 from your current IP

What often goes wrong is this: users open an account, buy the instance, then wait for verification to finish while assuming the server is ready. If you have time pressure, the account-side workflow should be completed before deploying anything that depends on SSH access.

Common registration or verification failures

• Name and ID mismatch
• Tencent Cloud KYC Linked Accounts Business registration documents not matching the billing entity
• Payment card country mismatch with account region
• Repeated failed attempts triggering additional review

These failures matter because they can delay EIP purchase, bandwidth activation, and renewals. In some cases, the instance exists but you cannot manage it normally until the review is cleared.

9) A practical troubleshooting flow I would use on a real case

1. Test from another network. If a hotspot works, the issue is your local network or IP whitelist.
2. Confirm the target IP. Make sure you are using the current public IP or EIP, not a private IP.
3. Check the Tencent Cloud console. Verify the instance is running and the account is not under payment or compliance restriction.
4. Inspect security group inbound rules. Open TCP 22 from your exact source IP for testing.
5. Check server-side firewall and sshd. If you can use console access, confirm SSH is listening and not blocked locally.
6. Review recent changes. New hardening script, system update, IP change, renewal lapse, or route change often explains the timeout.

This order saves time because it starts with the highest-probability problems and avoids wasting hours on Linux logs when the account is still pending review.

10) When to use console access instead of SSH

If SSH is down, but the instance is running, console access is the best way to recover. This is especially useful when:

• port 22 is blocked
• the wrong SSH key was uploaded
• Tencent Cloud KYC Linked Accounts sshd was disabled
• the firewall locked you out
• the instance lost public network access after a change

Tencent Cloud KYC Linked Accounts From the console, you can check the network config, repair SSH, and reopen access without relying on the internet path. In production, I recommend every team keep console access tested before relying on remote SSH alone.

Frequently asked questions

Why does SSH timeout instead of showing “connection refused”?

Timeout usually means packets are not getting a response at all. That points to a blocked path, wrong IP, security group restriction, firewall rule, or a stopped service behind a silent drop. “Connection refused” is more often a direct rejection from the host.

Can a billing issue cause SSH timeout?

Yes. If the instance, public IP, or bandwidth package is expired or restricted due to unpaid balance, remote access can fail in a way that looks exactly like a network timeout.

Do I need KYC before buying a CVM?

In many cases, yes, especially for full production use, certain regions, and enterprise billing. If your account is still unverified, expect delays in activation, purchasing public IP resources, or passing review.

Which payment method is least likely to cause delays?

The one that matches your account region, passes bank authorization cleanly, and does not require manual review. In practice, failed card auth and mismatched billing identities are common causes of delayed activation.

What if I can SSH from one network but not another?

That usually means the server is fine and the blocked network has an IP whitelist issue, corporate firewall restriction, VPN route issue, or ISP filtering. Compare the source IPs and security group rules.

Is a cheaper region better for CVM?

Not if you need reliable remote administration. A lower instance price can be offset by slower access, more network troubleshooting, and extra time spent fixing timeout issues.

What I would recommend in a real purchase decision

If your goal is to deploy a Tencent Cloud CVM that you can actually manage by SSH without surprises:

• finish identity verification before purchase
• use a payment method that your bank approves quickly
• choose a region close to where you will connect from
• attach a stable public IP or EIP if you need repeated remote access
• open security group port 22 only from trusted source IPs
• check renewal and billing status before the first timeout happens

Most SSH timeout cases are fixable in minutes once you know whether the blocker is account-related or network-related. The fastest teams are the ones that treat billing, KYC, and security group setup as part of the SSH deployment checklist, not as separate tasks.