:Troubleshoot connection failures to a Linux instance

Step 1: Use the self-service troubleshooting tool

The Alibaba Cloud self-service troubleshooting tool checks security group configurations, the instance internal firewall, and listener status for common ports. It generates a diagnostic report.

If the tool does not identify the issue, proceed to Step 2.

Step 2: Test the connection with Workbench

Use Workbench to test whether the SSH service on the instance is functioning.

1. Go to ECS console - Instances.

2. In the top navigation bar, select the region and resource group of the resource that you want to manage.

3. Click the ID of the target instance. On the instance details page, click Connect.

4. In the Remote connection dialog box, find Workbench and click Sign in now.

5. Confirm the prepopulated information, enter your username and authentication credentials, and attempt to log on.

For more information about Workbench, see Remotely log on to a Linux instance using Workbench.

Evaluate the result:

• Logon succeeds: The SSH service is running correctly. The issue is in the network path between your client and the instance. Proceed to Step 3.

• Logon fails: Workbench returns an error message and a solution. Follow the prompts to resolve the issue, then test again. For common Workbench errors, see Issues with VNC connections to an instance.

Step 3: Check the network

Verify that network connectivity exists between your client and the instance.

1. Test from a different network. Connect from a different network segment or a different internet service provider (ISP) to determine whether the issue is in your local network or on the server side.

   • If the issue is in your local network or ISP, contact your local IT staff or ISP for assistance.

   • If a network interface card driver is not working correctly, reinstall it.

2. Run a ping test. On your local machine, run:

   ping <instance-public-IP>

   • Packet loss or timeout: Use tracert (Windows) or mtr (Linux/macOS) to identify where packets are dropped. For more information, see Use MTR for network link analysis.

   • Network anomalies: Capture packets for analysis. For more information, see Use a packet capture tool to capture network packets.

   • Ping blocked: If the kernel does not prohibit ping requests but ping still fails, the instance operating system firewall may have a policy that drops ICMP packets from your IP.

For more information, see Troubleshoot a failure to ping the public IP address of an ECS instance.

Step 4: Check the port and security group

Verify that the security group allows inbound traffic on the SSH port.

1. Go to ECS console - Instances.

2. In the top navigation bar, select the region and resource group of the resource that you want to manage.

3. In the instance list, click the corresponding instance ID.

4. On the Security Groups tab, locate the security group and click Manage Rules in the Operation column.

5. On the Security Group Details page, in the Rules area, on the Inbound tab, click Add Rule and configure the rule with the following parameters:

   Parameter	Value
   Action	Allow
   Priority	1 (a smaller value indicates a higher priority; 1 is the highest priority)
   Protocol	Custom TCP
   Source	Your IP address. Find your IP address by visiting https://cip.cc/.
   Destination (Current Instance)	SSH (22)

6. Run the following command to verify the port is reachable:

   telnet <instance-IP> <port>

   Note

   Replace <instance-IP> with the IP address of the Linux instance and <port> with the SSH port number (default: 22).

   A successful response looks like this:

   Trying 192.168.0.1 ...
   Connected to 192.168.0.1.
   Escape character is '^]'

   Note

   For deeper SSH connection debugging, run:

   ssh -vvv <username>@<instance-IP>

   The verbose output shows each stage of the SSH handshake and helps pinpoint where the connection fails.

If the port test fails, see Troubleshoot port failures when an ECS instance can be pinged.

Step 5: Check CPU load, bandwidth, and memory

High resource utilization can cause connection failures or timeouts.