I'm running a Node.js backend on a Free-plan service that needs to make outbound SFTP (TCP/22) connections to two third-party hosts. Every connect attempt times out at the TCP layer — the SYN goes out but no SYN-ACK ever returns, after ~5 seconds the socket gives up. I'd like to confirm whether outbound port 22 is filtered on Free tier, and if so what the supported path is to unblock it.

What I'm seeing (consistent across both target hosts):

<dev/tcp> from inside the running container to ftp003.sonova.com:22 → timeout

Same to ftp.rex11.com:22 → timeout

Both hosts are publicly reachable on port 22 from my home network (verified via FileZilla and the macOS sftp CLI — successful SSH banner exchange + password prompt).

Outbound connections from the same Railway service to other services and ports work fine (Postgres on 5432, HTTPS APIs on 443).

I've tried explicit SSH algorithm overrides on the Node ssh2 library — no change in behaviour because we never get past TCP.

The diagnostic that confirms it's TCP-layer: I built a small probe endpoint that opens a raw TCP socket (no SSH involved) and waits for the SSH banner. The socket never reaches connect; it times out. So this isn't an SSH library issue — packets aren't getting through.

Questions:

Is outbound port 22 filtered on Free-plan services?

If yes, is there a Pro/Hobby plan tier where it's lifted, or a per-service exemption you can grant?

If no, can you suggest what else might be intercepting these packets? (Both target endpoints have firewalls but the symptom is identical — DROP-style — which would be unusual to be coincidental.)