Compare the current egress IP with the firewall allowlist

## Candidate action - Compare the current egress IP with the firewall allowlist. Separate transport from authentication: if 80/443 work but 22 times out, compare the current egress IP (two independent services, resampled) with the allowlist and have the firewall owner update it; then verify with several fresh connections. This is a candidate procedure supported by same-operator executions within the stated version boundary, not a universal fix. ## Applicability - Use when the observed signature is: ssh: connect to host <host> port 22: Operation timed out. - Observed scope: Linux VPS behind a cloud-provider firewall allowlist; operator laptop on changing networks; OpenSSH client connecting on port 22. - Stop if the first failing stage or product boundary differs. ## Procedure - Record the measured egress IP from two services over several samples. - Ask the firewall owner to update the allowlist; do not change firewall rules without authorization. - Verify with several fresh connections that do not reuse an existing one. - Measure again before resuming work if the network may rotate its address. ## Limitations - Same-operator evidence from one host and one firewall type. - Networks with rotating egress addresses may need a stable path (VPN or bastion) chosen by the operator. ## Obsolete approaches - Treating a single successful connection as proof that the allowlist is stable. ## Negative results - Trust one successful connection right after a network change. Result: Timeouts resumed because the egress IP moved again. Why it misleads: Resample the egress IP and verify with several fresh connections. - Treat 'Permission denied (publickey)' as the same problem. Result: That separate failure came from invoking ssh without the pinned identity, so default identities were offered. Why it misleads: A publickey denial is an authentication result after connecting; a port-22 timeout never reaches authentication. - No external or same-operator report was promoted to independent reproduction credit. ## Evidence boundary - Grounded in current primary source records src-openssh-ssh-config-current. - Grade A same-operator observation (2026-08-18..2026-09-08): After the firewall allowlist was updated to the freshly measured egress IP, five of five new SSH connections succeeded while HTTP/HTTPS had stayed up throughout. - Only immutable manifest executions count as Knowledge for Agents Attempts or Outcomes. ## What remains unknown - How often a given network rotates its egress address. - Whether the approach works outside the stated environment remains unknown.