ssh: connect to host port 22: Connection refused
Your client reached the host’s IP, but nothing accepted TCP on that port. Connection refused is an active rejection — usually sshd is down, listening elsewhere, or you aimed at the wrong port.
How it shows up
ssh: connect to host 203.0.113.10 port 22: Connection refused
ssh: connect to host example.com port 22: Connection refused
kex_exchange_identification: Connection closed by remote host
(sometimes after a refused/retry path)Verbose mode stops before any key exchange banners from sshd:
ssh -vvv [email protected]
# … look for "connect to address … port 22: Connection refused"Refused vs timed out vs auth failures
| Message | Layer | Typical cause |
|---|---|---|
| Connection refused (port 22) | TCP | Host up; nothing listening on that port / sshd stopped / wrong port |
| Connection timed out | TCP | Firewall drop, blackhole route, host down, security group with no reply |
| Permission denied (publickey) | SSH auth | sshd is up; keys/users/sshd_config rejected you |
| REMOTE HOST IDENTIFICATION HAS CHANGED | Host key | sshd answered; known_hosts conflict |
| localhost refused to connect | Local TCP | Same idea for a local app port, not necessarily SSH |
Rule of thumb: timeout ≈ “silence / drop”. Refused ≈ “something said no on that port”. Auth errors ≈ “SSH protocol started”.
Frequent real causes
- sshd not running — after reboot, failed upgrade, or container without an SSH daemon.
- Wrong port — server listens on 2222 / 2200 but client still uses 22 (missing
-porPortin~/.ssh/config). - sshd bound to another address —
ListenAddressonly on a private IP; you hit the public one. - Provider / image without SSH — some minimal cloud images or PaaS boxes expect a serial/console or web shell only.
- Hitting a different host — stale DNS, wrong inventory IP, load balancer with nothing on 22.
- Local firewall REJECT — rarer than DROP (DROP → timeout), but a REJECT policy yields refused.
Diagnose
# From your laptop: does anything accept 22?
nc -vz example.com 22
# or
curl -v telnet://example.com:22
# On the server (console / VNC / provider serial):
sudo systemctl status ssh # Debian/Ubuntu
sudo systemctl status sshd # RHEL/Fedora/CentOS
sudo ss -ltnp | grep -E ':22|:2222'
sudo journalctl -u ssh -n 50 --no-pager
# Configured port?
grep -E '^(Port|ListenAddress)' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* 2>/dev/nullIf ss -ltnp shows sshd on :2222 only, connect with ssh -p 2222 user@host. Port numbers as plain integers are easy to mix up — the number base converter is handy when a panel shows hex.
Fix checklist
- Confirm refused vs timeout — if it always times out, follow Connection timed out (security groups, ufw, iptables DROP) instead of restarting sshd blindly.
- Start sshd —
sudo systemctl start ssh(orsshd) andenableit for boot; watch status for config errors. - Match the port — client
-p/Portmust equal sshd’sPort; update cloud “SSH port” firewall rules to match. - Listen address — ensure sshd listens on the interface you reach (or
0.0.0.0/::as appropriate). - Right host — resolve DNS, compare inventory; a refused public IP may simply not be the VM you think.
- After TCP works — next failures are usually keys (publickey) or host key warnings (host key verification failed).
# Once listening, a banner should appear:
ssh -v -p 22 [email protected]
# look for "Remote protocol version" / offer of host keysRelated
What port 22 and other common ports are for · ssh Connection timed out port 22 · Permission denied (publickey) · SSH host key verification failed · SSH key permissions are too open · localhost refused to connect · ECONNREFUSED ::1 · ERR_NAME_NOT_RESOLVED · Anvil HTTP status
Questions
What does ssh Connection refused port 22 mean?
The client reached the host’s address, but nothing accepted TCP on port 22 (or the port you requested). Usually sshd is down or listening on another port.
How is Connection refused different from Connection timed out?
Refused means the host answered with a TCP reset/reject on that port. Timed out means no useful reply — often a firewall drop, wrong route, or host unreachable.
How is this different from Permission denied (publickey)?
Permission denied means sshd is running and speaking SSH; your keys or user were rejected. Connection refused never gets that far.
sshd is installed — why still refused?
The service may be stopped, failed to start after a config typo, or bound to a different Port / ListenAddress than the one you dial.
How do I connect if SSH is on port 2222?
ssh -p 2222 user@host, or set Port 2222 in ~/.ssh/config for that Host. Open the same port on the cloud firewall.
Can a firewall cause Connection refused?
Yes if the policy is REJECT. Many cloud security groups DROP instead, which looks like a timeout. Check both.
What should I do from the provider console?
systemctl status ssh/sshd, ss -ltnp | grep 22, fix Port/ListenAddress, start the service, then retry from your laptop.
Published · updated .