Linux SSH connection refused: diagnose and fix it

What this covers

"Connection refused" means your client reached the machine but nothing answered on the SSH port. Work through the port test, the daemon status, the firewall, and the config in order — most cases are resolved by one of these four.

Symptom

Test whether port 22 is reachable

"Connection refused" usually means nothing is listening on the SSH port or a firewall is blocking it. Use netcat against the server's port 22: a succeeded connection means sshd is up and the port is open, so look elsewhere; a refused or timed-out result points at the daemon or firewall. Swap in your server's hostname or IP for the target.

$ nc -zv example.com 443

Check whether sshd is actually running

If the port test failed, the most likely cause is that the SSH daemon isn't running. On the server, inspect the sshd unit: the status output shows whether it's active, when it last restarted, and the most recent log lines — a config error or crash will usually be visible right there. If it shows inactive or failed, you've found your answer.

$ systemctl status nginx

Open port 22 in the firewall

If the daemon is running but the port test still fails, a host firewall like UFW may be blocking inbound SSH. Allow TCP port 22 through UFW, then re-run the port test from your client — it should now succeed. If you need to undo the rule later, the rule can be deleted explicitly. This changes your firewall exposure, so only open ports you intend to serve.

$ sudo ufw allow 22/tcp

$ sudo ufw delete allow 22/tcp

Validate sshd_config before restarting

A typo in /etc/ssh/sshd_config can make sshd fail to start — a classic hidden cause of connection refused. Dry-run the configuration with sshd -t before any restart: no output means the config is valid; errors are printed with line numbers so you can fix them. Once it passes, restarting the daemon should bring SSH back, and the port test should connect.

$ sudo sshd -t
sudo sshd -T | grep -i permitrootlogin

How to confirm it worked

Re-run the netcat port test against port 22 — it should report success — and then connect with ssh; you should get a login prompt or shell.

Undo everything

Every command above can be reverted. Run these in order to undo all of it.

$ sudo ufw delete allow 22/tcp

Review before running — some steps may not be independent.

Sources

• nc(1) — arbitrary TCP and UDP connections and listens (OpenBSD netcat)
  Ubuntu Manpages · technical · 2026-09-17
  Evidence: Documents -z (zero-I/O scan mode) and -v (verbose) for testing if a port is open without sending data
• OpenSSL — ArchWiki
  ArchWiki · community · 2026-09-17
  Evidence: ArchWiki network troubleshooting pages commonly recommend nc -zv for quick port reachability checks
• Ubuntu Manpage: systemctl - Control the systemd system and service manager
  manpages.ubuntu.com · technical · 2026-09-17
  Evidence: "status [PATTERN...|URL...] Show terse runtime status information about one or more units ... This function is intended to generate human-readable output ... along with the most recent log data."
• systemctl(1) — Arch Linux manual
  man.archlinux.org · technical · 2026-09-17
  Evidence: "status [PATTERN...|URL...] — Show terse runtime status information about one or more units, followed by most recent log data from the journal."
• UncomplicatedFirewall - Ubuntu Wiki
  Ubuntu Wiki · vendor-doc · 2026-09-17
  Evidence: The Ubuntu UFW wiki describes enabling the firewall with ufw enable and adding allow rules by port and protocol.
• ufw(8) — program for managing a netfilter firewall
  Ubuntu manpages · vendor-doc · 2026-09-17
  Evidence: The ufw manual documents 'ufw allow' rules with PORT/PROTO syntax such as 22/tcp and matching 'ufw delete allow' to remove them.
• sshd(8) — Linux manual page
  man7.org · technical · 2026-09-17
  Evidence: sshd man page: '-t Test mode. Only check the validity of the configuration file and sanity of the keys' and '-T extended test mode printing effective config'.

Last verified: 2026-09-21

Related guides