How to Fix SSH Connection Refused Errors

Secure Shell (SSH) is one of the most essential protocols for remote server administration. Whether you manage a Linux server, VPS, cloud instance, Raspberry Pi, or enterprise infrastructure, SSH allows you to securely access and control remote systems through an encrypted connection.
However, one of the most frustrating problems administrators encounter is the "SSH Connection Refused" error. Unlike timeout errors that often indicate network connectivity problems, a connection refused error usually means that your computer successfully reached the destination machine, but the SSH service rejected the connection because it is not accepting SSH requests.
This issue can occur after a server reboot, firewall modification, operating system update, SSH configuration change, or even during the initial server setup. Fortunately, the error is usually straightforward to diagnose once you understand what causes it.
This comprehensive guide explains the meaning of the SSH Connection Refused error, its most common causes, and step-by-step solutions to restore SSH access quickly.

What Does "SSH Connection Refused" Mean?

When you attempt to connect using SSH, you may receive an error similar to :
ssh: connect to host 192.168.1.100 port 22: Connection refused
or
Connection refused
This message indicates that :

The target server is reachable.
The network connection is working.
No service is accepting connections on the requested SSH port.

In simple terms, your computer knocked on the server's door, but nobody answered because the SSH service is unavailable or blocked.

Common Causes of SSH Connection Refused

Several issues may trigger this error, including :

SSH service is not running
SSH server package is missing
Incorrect SSH port
Firewall blocking port 22
SSH daemon configuration errors
TCP Wrappers restrictions
SELinux restrictions
Cloud security group blocking SSH
Server boot problems
Listening on a different network interface
Port forwarding problems
Network configuration errors

Finding the root cause requires checking each possibility systematically.

How to Fix SSH Connection Refused Errors (Step-by-Step)

Step 1: Verify the Server Is Reachable

Before troubleshooting SSH itself, ensure the server is online.
Run : ping server-ip
Example : ping 192.168.1.100
If the server responds, the network connection is functioning.
If Ping fails :

Check physical network connections.
Verify the server is powered on.
Confirm the IP address is correct.
Check router or switch connectivity.

Step 2: Confirm the Correct IP Address

A surprisingly common mistake is attempting to connect to the wrong server.
Check the server IP locally : ip addr or hostname -I
Compare the displayed IP address with the one used in your SSH command.

Step 3: Verify the SSH Service Is Running

The SSH daemon must be active before it can accept incoming connections.
Check its status : sudo systemctl status ssh
On some distributions : sudo systemctl status sshd
If the service is inactive, start it : sudo systemctl start ssh
Enable automatic startup : sudo systemctl enable ssh
Verify the service again.

Step 4: Restart the SSH Service

Sometimes the daemon is running but becomes unstable after configuration changes.
Restart it :
sudo systemctl restart ssh
or
sudo systemctl restart sshd
Attempt the SSH connection again afterward.

Step 5: Ensure OpenSSH Server Is Installed

Some Linux installations include only the SSH client.
Check : which sshd
If nothing is returned, install the server package.
Ubuntu/Debian :
sudo apt update
sudo apt install openssh-server
CentOS/RHEL : sudo yum install openssh-server
Fedora : sudo dnf install openssh-server
Arch Linux : sudo pacman -S openssh
Start the service after installation.

Step 6: Check Whether SSH Is Listening

Determine whether the SSH daemon is actually accepting connections.
Run :
sudo ss -tlnp | grep ssh
or
sudo netstat -tlnp | grep ssh
Expected output :
LISTEN 0 128 0.0.0.0:22
or
LISTEN 0 128 :::22
If nothing appears, SSH is not listening.

Step 7: Verify the SSH Port

SSH normally uses port 22.
However, administrators often change it for security reasons.
Check : sudo nano /etc/ssh/sshd_config
Look for : Port 22
It may instead contain : Port 2222
If so, connect using : ssh -p 2222 username@server

Step 8: Validate the SSH Configuration File

Configuration mistakes prevent SSH from starting.
Test the configuration : sudo sshd -t
If errors appear, correct them before restarting SSH.
Common mistakes include :

Missing quotes
Duplicate directives
Incorrect syntax
Invalid authentication settings

Step 9: Review SSH Log Files

Logs often reveal the exact reason SSH is failing.
Ubuntu : sudo journalctl -u ssh or sudo cat /var/log/auth.log
CentOS : sudo journalctl -u sshd or sudo cat /var/log/secure
Look for messages indicating :

Configuration failures
Authentication problems
Missing host keys
Permission issues
Startup errors

Step 10: Check Firewall Rules

Firewalls frequently block SSH connections.
Ubuntu UFW : sudo ufw status
Allow SSH : sudo ufw allow ssh or sudo ufw allow 22/tcp
Firewalld : sudo firewall-cmd --list-services
Allow SSH :
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload
iptables : sudo iptables -L
Ensure port 22 is not blocked.

Step 11: Verify Cloud Security Groups

Cloud providers often use external firewalls.
Check your security rules if using :

AWS EC2
Google Cloud
Microsoft Azure
Oracle Cloud
DigitalOcean
Vultr
Linode

Ensure inbound TCP traffic is allowed for the SSH port.

Step 12: Check SELinux

SELinux may prevent SSH from listening correctly.
Check its status : getenforce
If troubleshooting, temporarily switch to permissive mode :
sudo setenforce 0
If SSH starts working, adjust the SELinux policy instead of leaving it disabled permanently.

Step 13: Verify TCP Wrappers

Older Linux systems may use TCP Wrappers.
Inspect :
/etc/hosts.allow
and
/etc/hosts.deny
A restrictive rule such as :
sshd: ALL
inside hosts.deny blocks every SSH connection.

Step 14: Confirm SSH Is Listening on the Correct Interface

Your SSH daemon may only listen on localhost.
Check : ListenAddress
Inside : /etc/ssh/sshd_config
Avoid settings like : ListenAddress 127.0.0.1
Instead use : 0.0.0.0
or leave it commented to allow all interfaces.

Step 15: Verify Port Forwarding

If connecting through a home router :

Confirm port forwarding exists.
Forward TCP port 22.
Verify the internal IP address.
Ensure no duplicate forwarding rules exist.

Step 16: Test the SSH Port

Use Netcat : nc -zv server-ip 22
Or Telnet : telnet server-ip 22
If the port refuses the connection, the SSH service is unavailable.

Step 17: Check for Fail2Ban Blocks

Servers protected by Fail2Ban may temporarily block your IP after repeated login failures.
Check : sudo fail2ban-client status sshd
Unban your IP : sudo fail2ban-client set sshd unbanip YOUR_IP

Step 18: Restore Missing SSH Host Keys

If SSH reports missing host keys, regenerate them :
sudo ssh-keygen -A
Restart SSH afterward :
sudo systemctl restart ssh

Step 19: Check File Permissions

Incorrect permissions may prevent SSH from starting.
Verify : ls -ld /etc/ssh
Typical permissions : drwxr-xr-x
Configuration files should remain readable by root.

Step 20: Reinstall OpenSSH Server

If configuration files are badly corrupted, reinstalling SSH is often the quickest solution.
Ubuntu :
sudo apt remove openssh-server
sudo apt install openssh-server
CentOS : sudo yum reinstall openssh-server
Restart the service afterward.

Preventing SSH Connection Refused Errors

To reduce the likelihood of future SSH issues :

Enable automatic SSH service startup.
Keep OpenSSH updated.
Test configuration changes before restarting the daemon.
Backup SSH configuration files.
Monitor firewall changes.
Use server monitoring tools.
Document custom SSH ports.
Avoid unnecessary configuration modifications.
Regularly review authentication logs.
Maintain backup console access for remote servers.

Best Practices for Secure SSH Access

After restoring SSH connectivity, strengthen your server security by :

Using SSH keys instead of passwords.
Disabling root login when possible.
Changing the default SSH port if appropriate.
Enabling Fail2Ban.
Restricting access with firewall rules.
Allowing only specific users.
Keeping the operating system updated.
Monitoring login attempts regularly.
Using multi-factor authentication where supported.

These practices improve security without sacrificing remote accessibility.

Conclusion

The SSH Connection Refused error is usually a sign that the remote server is reachable but not accepting SSH connections. In most cases, the issue stems from a stopped SSH service, an incorrect port, firewall restrictions, configuration errors, or missing server components.
By following the troubleshooting steps in this guide—starting with basic network checks, verifying that the SSH daemon is running, inspecting configuration files, reviewing logs, and confirming firewall and cloud security settings—you can systematically identify and resolve the problem. Once SSH access is restored, adopting security best practices such as key-based authentication, regular updates, and proper firewall management will help ensure reliable and secure remote administration in the future.

Related Posts :

FAQ - How to Fix SSH Connection Refused Errors

What does "SSH Connection Refused" mean?

The "SSH Connection Refused" error means that your computer successfully reached the remote server, but the server is not accepting SSH connections on the specified port. This usually happens because the SSH service is stopped, misconfigured, or blocked by a firewall.

Why is my SSH server refusing connections?

An SSH server may refuse connections if the SSH daemon is not running, the SSH port is incorrect, firewall rules block access, the SSH configuration file contains errors, or cloud security settings deny incoming connections.

How do I check if the SSH service is running?

On most Linux distributions, you can check the SSH service by running :
sudo systemctl status ssh
or
sudo systemctl status sshd
If the service is inactive, start it with the appropriate systemctl start command.

Can a firewall cause an SSH Connection Refused error?

Yes. Firewalls such as UFW, firewalld, iptables, or cloud security groups can block the SSH port, preventing incoming connections even if the SSH service is running.

How can I find the SSH port used by my server?

You can check the SSH port by opening the SSH configuration file :
sudo nano /etc/ssh/sshd_config
Look for the Port directive. If no custom port is specified, SSH typically uses port 22.

What is the difference between "Connection Refused" and "Connection Timed Out" in SSH?

A Connection Refused error means the server is reachable but no service is accepting connections on the target port. A Connection Timed Out error usually indicates a network connectivity issue, firewall blockage, or an unreachable server.

How do I restart the SSH service on Linux?

You can restart the SSH service using :
sudo systemctl restart ssh
or on some distributions :
sudo systemctl restart sshd
Restarting the service can resolve temporary issues after configuration changes.

Why is SSH not listening on port 22?

SSH may not be listening on port 22 if the SSH service failed to start, the configuration specifies a different port, another application is using port 22, or the SSH configuration contains syntax errors.

How can I test whether the SSH port is open?

You can test the SSH port using Netcat :
nc -zv server-ip 22
or Telnet :
telnet server-ip 22
If the connection is refused, the SSH service may not be running or the port may be blocked.

How can I prevent SSH Connection Refused errors in the future?

To reduce the chances of SSH connection problems, keep the SSH service enabled at startup, regularly update OpenSSH, verify firewall rules after changes, back up your SSH configuration, monitor system logs, and test configuration updates before restarting the SSH service.

Friday, July 31, 2026