Unable to connect to the ESXi Host using SSH. Failing with "Network error: Connection timed out"

Products

• VMware vSphere ESXi

Issue/Introduction

Unable to connect to the ESXi Host using SSH via PuTTY from their local workstation. The connection attempt fails and generates the following error message:
Network error: Connection timed out

 

• Host-Side Services Healthy: The host's core management agents (hostd, vpxa) and the SSH daemon (/etc/init.d/SSH) are running normally.

• Port Binding Active: The ESXi host is actively listening for incoming TCP requests on Port 22 via Telnet.

• ESXi Firewall Allowed: The built-in security profile for sshServer is explicitly set to permit connections from All source IP addresses. The host is not dropping the packets locally.

• Alternative Path Successful: An SSH session initiated directly from the vCenter Server Appliance to the ESXi host succeeds, confirming the host accepts connections from the management subnet but drops/times out when accessed via the local client workstation IP.

 

Environment

VMware vSphere ESXi

Cause

This is an external network-layer block (such as a hardware firewall rule, router Access Control List, or strict routing policy). This block is preventing traffic on TCP Port 22 from successfully routing between the  local workstation subnet and the ESXi management network subnet.

Resolution

To restore SSH access, choose one of the following approaches based on organization's security guidelines:

Option A: Implement a Network Firewall Rule (Permanent Fix) Engage Network Security/Infrastructure team to permit inbound TCP Port 22 traffic through the corporate firewall environment:

1. Source: [Workstation IP Address / Local Subnet]

2. Destination: [ESXi Host Management IP Address]

3. Protocol/Port: TCP / 22

4. Action: Allow

Option B: Utilize a Jump-Box / Proxy Session (Immediate Workaround) If direct network access from workstation subnets to the management plane is restricted by company policy, utilize the vCenter appliance network route as a secure jump path:

1. Establish a PuTTY session to your vCenter Server Appliance.

2. Once logged into the vCenter shell, execute the following command to securely bridge to the ESXi host: ssh root@<ESXi_Host_IP_Address>