Bulk Verified Tencent Cloud Accounts How to Troubleshoot Unreachable Tencent Cloud CVM Instance

Why “Unreachable” Happens (And Why It’s Usually Not Personal)

Being unable to reach your Tencent Cloud CVM instance feels like the network is ghosting you. One minute you’re confidently connecting via SSH, the next minute you’re staring at errors that look like they were generated by a dramatic screenplay: timeout, connection refused, no route to host, or the ever-popular “it’s unreachable.” The good news is that most root causes are boring and fixable. The bad news is that boring problems often hide behind an overly-confident assumption such as “we changed nothing.”

This article shows a structured troubleshooting workflow. The key idea is simple: verify the problem stage-by-stage, from the outside world to your VM’s operating system. When you do it this way, you’re not guessing wildly. You’re eliminating entire categories of failure until the culprit is revealed—usually wearing a hoodie made of misconfigured security rules.

Stage 0: Identify the Exact Symptom (So You Don’t Chase the Wrong Dragon)

Start by writing down what “unreachable” means in your case. Different error messages point to different failure layers:

• Timeout (connection attempt waits and then dies): often network path, security group, firewall drop rules, NACL, wrong route, or a downed instance.
• Connection refused: the network path exists, but the target port is closed or the service isn’t listening (e.g., SSH disabled).
• No route to host: routing issue, invalid IP, or network segmentation problems.
• Bulk Verified Tencent Cloud Accounts Authentication errors: connectivity is fine; you’re getting blocked by credentials or keys (not “unreachable,” but still worth checking).

If you can, test both TCP-level reachability and the specific service port (commonly 22 for SSH, 3389 for RDP). Don’t rely solely on one tool or one machine. A connectivity test from the same environment where you normally connect can quickly rule out local networking issues.

Stage 1: Confirm You’re Targeting the Correct Instance (The “Wrong IP” Classic)

Before you dive into firewall rules or start bargaining with the gods of routing tables, confirm the basics:

• Confirm the instance ID (CVM) you think you’re connecting to is the same one you’re actually targeting.
• Verify the correct public IP and port forwarding details (if applicable).
• Check whether the instance has been restarted, rebuilt, or had its IP changed.
• If you use an internal-only IP, confirm you’re connecting from a network that has a route to that internal address.

Common scenario: you copied an IP from an earlier attempt, then spun up a new VM, and now the old IP is a parking lot with no cars. It happens to the best of us. Logs may show you hitting the correct host in theory, but theory doesn’t matter if the IP is wrong.

Stage 2: Validate Tencent Cloud Network Reachability (From the Provider Side)

Your next stop is the Tencent Cloud console. You want to verify that the instance’s network resources allow inbound traffic to the port you’re using.

2.1 Check Security Group Rules (Ingress) for the Right Port

Security groups are often the culprit. Confirm:

• The security group attached to the CVM allows inbound traffic to your required port (SSH 22, RDP 3389, etc.).
• The protocol matches (TCP/UDP).
• The source IP/CIDR is correct. “Allow from 0.0.0.0/0” is sometimes used temporarily, but many teams restrict by office IP ranges. If the source changed, your packets get politely ignored.
• If you recently changed network segmentation, the allowed CIDR might no longer match.

Humorous but true: security group rules don’t care that you “definitely used to connect.” They only care what they currently say.

2.2 Verify Any Network ACL (If Enabled)

Some setups use additional access controls like NACLs (Network Access Control Lists). If your account or environment has them enabled, check:

• Whether outbound/inbound rules allow the traffic.
• Port ranges and direction.
• Whether the rule is set to deny by default (or simply not allow what you need).

Think of NACLs as bouncers at the club and security groups as a guest list. Even if you’re on the guest list, the bouncer can still say “nope.”

2.3 Confirm Public IP / Elastic IP / NAT Settings (If You Use Public Access)

If you connect via a public IP, ensure:

• The instance has a public IP assigned (or an Elastic IP mapped to it, depending on your setup).
• Your public IP is indeed associated with this instance.
• If you use NAT, port mapping, or load balancers, confirm the forwarding rules route to your instance and the correct port.

In some configurations, the instance has no direct public address, and you’re expected to access through a bastion host. If you forgot that detail, you might spend 40 minutes blaming the instance for refusing to be reached through a door that was never installed.

Stage 3: Confirm the Instance Itself Is Running and Healthy

Sometimes “unreachable” is simply because the VM is down, paused, or otherwise not serving traffic.

• Check the instance status in the console: running vs. stopped.
• If you can, check system health indicators (if available).
• Look for recent changes: reboots, OS updates, failed provisioning, security policy updates.

If the instance is stopped, no amount of firewall tuning will let you SSH into it. While that seems obvious, many “fast debugging sessions” start only to discover the VM was accidentally stopped by an overly helpful automation script.

Stage 4: Verify OS-Level Network and SSH (When the Network Path Is Actually Fine)

If you’ve confirmed cloud-level networking and security settings are correct, the next suspects live inside the VM: SSH configuration, firewall on the OS, and network service health.

4.1 Can You Reach the Port at All?

If you have any way to test from a reachable environment (a jump host, VPC peer, or internal test machine), run a basic connectivity test:

• From a Linux machine: use nc or telnet style tests.
• Check whether TCP connections to the port succeed or are refused.

If you get timeout, it’s likely blocked upstream or the instance isn’t responding on that port. If you get connection refused, you’ve probably got a reachable IP but the service isn’t listening.

4.2 Check SSH Service Status (Linux)

On the VM (if you have access via console/serial, or if you can temporarily regain access), inspect:

• Is SSH server installed?
• Is it running?
• Is it bound to the right address?
• Is the port correct?

Typical checks (commands vary slightly by distro):

# Systemd-based systems
sudo systemctl status ssh
sudo systemctl status sshd

# Start if needed
sudo systemctl start sshd
sudo systemctl enable sshd

# Verify listening port
sudo ss -lntp | grep -E ':22|sshd'

If SSH isn’t running, your “unreachable” becomes “reachable but no one is home.” Often SSH stopped after an update, a misconfiguration, or a failed deployment that edited the config in a moment of stress.

4.3 Check SSH Configuration (sshd_config)

Sometimes SSH is running, but its config blocks clients. Look for common gotchas:

• Port is changed but you still try port 22.
• ListenAddress is set too narrowly.
• PasswordAuthentication is disabled and you’re using passwords instead of keys (not unreachable, but you’ll still get errors).
• AllowUsers or DenyUsers restricts accounts.
• AllowGroups / DenyGroups blocks your user.

Also check config syntax before restarting:

sudo sshd -t

If that command complains, don’t restart the service blindly. You might have a configuration error that makes SSH fail to load, resulting in “connection refused” or no listening port.

4.4 Check OS Firewall Rules (iptables / nftables / ufw)

Even if the cloud security group allows the traffic, the OS firewall can still block it. Check your firewall status:

• iptables: rules may drop inbound 22.
• Bulk Verified Tencent Cloud Accounts ufw: default deny inbound might block SSH.
• firewalld: active zones might not permit SSH service.

Example checks:

# ufw
sudo ufw status verbose

# firewalld
sudo firewall-cmd --state
sudo firewall-cmd --list-all

# iptables (basic)
sudo iptables -S | grep 22

If you find rules blocking port 22, temporarily allow it from your IP (principle of least drama):

# Example with ufw (if installed)
sudo ufw allow from YOUR_IP to any port 22 proto tcp

Remember to remove temporary broad allowances later. A firewall opened to the whole internet is like leaving your wallet on the hood of a speeding car. It might “work” for a while, but eventually reality collects payment.

Stage 5: Diagnose Network Interfaces and Routing Inside the VM

Bulk Verified Tencent Cloud Accounts If SSH isn’t listening or the OS firewall looks fine, it may be a lower-level issue: network interface down, missing IP address, routing misconfiguration, or DNS confusion.

5.1 Verify Network Interface Status

Check that the relevant interface is up and has the expected IP:

ip addr
ip link
ip route

Look for:

• The interface is UP.
• The VM has the expected internal IP address (and any configured public-facing mapping, if applicable).
• Routes exist for the network you’re trying to reach.

5.2 Check Default Route and DNS (DNS Won’t Fix “Unreachable,” But It Will Confuse Your Testing)

DNS issues can make it feel like the host is unreachable if you’re connecting by hostname rather than IP. Still, it won’t usually cause raw TCP timeouts. But for completeness:

cat /etc/resolv.conf
ip route | grep default

If DNS servers are wrong, your name resolution fails. But if you test by IP and it still fails, DNS isn’t the main villain.

Stage 6: Review Recent Changes and “What Did We Touch?”

Unreachable incidents often follow a change. Common culprits include:

• Security group edits.
• OS firewall rule modifications.
• Updates that restarted or removed SSH configs.
• Key rotation (you deployed new keys but didn’t update authorized_keys).
• Network interface or routing changes.
• Disk full events causing services to fail (e.g., logs filling disk, SSH refusing due to system issues).

If you can, check system logs from the VM console:

# Common locations
sudo journalctl -u ssh --no-pager -n 100
sudo journalctl -xe --no-pager -n 100

# For older syslog setups
sudo tail -n 100 /var/log/auth.log
sudo tail -n 100 /var/log/secure

Look for SSH startup errors, config parsing failures, firewall reload problems, or kernel/network errors.

Stage 7: Use Tencent Cloud Console Features for Recovery (If You Can’t SSH)

If you can’t reach the VM from the network, you still might have rescue options depending on your account and setup:

• Use the Tencent Cloud console’s instance access features (like VNC/console or remote command execution, if available).
• Check if there are “serial console” or “reinstall with data retention” options.
• If you have a managed agent, verify it’s healthy.

The exact features depend on your Tencent Cloud product configuration, but the concept is consistent: don’t let lack of network access stop you from examining the instance state. Sometimes the VM is fine; you just lost the ability to connect. Other times, the VM is in a broken state but you can fix it with console access.

Stage 8: Common Root Causes (With Practical Fix Directions)

Below is a list of frequently observed “unreachable CVM” causes and what to do next. Use this like a choose-your-own-adventure book, except the villain is always a configuration setting.

8.1 Security Group Doesn’t Allow Inbound SSH

Symptom: timeout from outside, sometimes only certain sources fail.

Fix:

• Add an inbound rule for TCP port 22 (or your actual SSH port).
• Ensure the source CIDR matches where you connect from.

8.2 OS Firewall Blocks SSH

Symptom: connection timeout or refused depending on firewall behavior; cloud rules look correct.

Fix:

• Allow port 22 on the OS firewall.
• Bulk Verified Tencent Cloud Accounts Check firewall default policy and active zones.

8.3 SSH Service Not Running or Not Listening on the Right Port

Symptom: connection refused.

Fix:

• Start the SSH service.
• Verify sshd is listening on port 22.
• Fix sshd_config (Port, ListenAddress, AllowUsers, etc.).

8.4 Wrong IP, Wrong Network, or You’re Connecting from the Wrong Place

Symptom: timeout/no route to host. Sometimes everything “looks right” in your head.

Fix:

• Re-check the instance’s public and private IPs.
• Confirm your client machine network can reach that address.
• If private only, use a bastion/jump host or VPN into the VPC.

8.5 Instance Is Stopped, Unhealthy, or Disk Is Full

Symptom: unreachable/timeouts; services may be down.

Fix:

• Check instance status.
• From console, verify system resources: disk usage, process status.
• Clean disk space if logs or temp files are causing service failures.

Stage 9: A Simple “Do This Next” Checklist

If you want a quick workflow to stop the bouncing around, here’s a straightforward checklist:

1. Confirm the instance ID and IP you’re targeting.
2. From your client, note the error type (timeout vs refused).
3. Check Tencent Cloud security group inbound rules for your port and source CIDR.
4. Check NACL (if in use) for inbound/outbound rules.
5. Bulk Verified Tencent Cloud Accounts Confirm public IP / mapping if you rely on public access.
6. Confirm instance state is running and healthy.
7. Get OS console access if SSH is unreachable.
8. Check SSH service status and listening port.
9. Check OS firewall for blocking rules.
10. Inspect system logs for SSH startup/config errors.
11. Check network interface and routes inside the VM.

Follow the list in order. If you skip to the firewall rules immediately, you might be doing a full-body apology dance to the wrong component.

Stage 10: Verification After Changes (So You Know You Fixed It)

Once you apply a fix, verify methodically:

• Re-test connectivity to the specific port (22 or your SSH port).
• Confirm SSH banner or handshake works (if you see an authentication prompt, you’re in).
• Check that the change doesn’t break other expected access (e.g., different ports or internal clients).

Bulk Verified Tencent Cloud Accounts If the problem remains, revert the last change (if it was a temporary broad allowance) and continue down the troubleshooting stages. Treat troubleshooting like debugging a mystery: change one thing at a time when possible, so you can identify what actually moved the needle.

Bulk Verified Tencent Cloud Accounts Extra Tips (Because You’re Going to Hit Something Strange)

Tip 1: Use Internal Tests If Possible

If you have other VMs in the same VPC, test from there. It helps separate “cloud-level public routing issues” from “OS/service issues.” If internal connectivity works but public doesn’t, you’re likely dealing with public IP mapping, route tables, or security group rules tied to public sources.

Tip 2: Don’t Forget the Return Path

Security controls are often asymmetric in how people think. You allow inbound, but the return path might be blocked by:

• Outbound security rules (if applicable in your setup)
• NACL rules that block ephemeral ports
• OS firewall policies that only allow certain directions

Remember: TCP isn’t a one-way message. The reply must be able to leave the VM and reach your client.

Tip 3: If You Changed SSH Port, Update Your Client and Rules

When you change SSH from 22 to another port, update:

• The OS firewall to allow the new port.
• The cloud security group to allow the new port.
• Your client’s SSH command to use -p.

This is the kind of “one small change” that causes an hour of confusion. Small change, big drama.

When All Else Fails: Safe Escalation and Recovery

If you’ve checked everything you can and the instance still can’t be reached, consider escalation:

• Open a support ticket with Tencent Cloud, including timestamps, error messages, instance ID, region, and screenshots of security group rules.
• Provide details of what you tested (public IP reachability, port tests, security group rules, OS logs if available).

While waiting, you can still aim for minimal-risk recovery:

• If you must regain access, consider using console access to restore SSH settings.
• If the OS is severely compromised or broken, you might restore from snapshots or re-provision (depending on your operational policy).

Try to avoid “hero actions” like disabling firewalls broadly across the board. It may restore connectivity quickly, but it can also turn your debugging session into a security incident cleanup. We prefer fewer fireworks.

Conclusion: Troubleshoot Like a Detective, Not Like a Chef

Unreachable Tencent Cloud CVM instances are rarely mysterious once you approach them systematically. Treat network reachability as a pipeline: cloud security controls, routing/public IP mapping, instance health, then OS services and firewall rules. Record your error symptoms, confirm the target IP and port, and move stage-by-stage until you find the broken link.

And if you still can’t connect after all that? At least you’ll have earned the right to say, with confidence, “We didn’t just vibe-check the problem. We actually interrogated it.” That’s the difference between troubleshooting and performing interpretive networking.