What it means
ssh: connect to host 203.0.113.10 port 22: Connection refusedThe connection never got as far as SSH. Keys, passwords and users play no part yet, so do not change them. A refusal is a quick, active answer, which tells you something useful: a machine or a firewall on that path is responding. If nothing answers at all, you get a different error, covered in Connection timed out.
First: test the port from your computer
nc -vz 203.0.113.10 22
ssh -G server | grep -E '^(hostname|port) 'The first line tests the port without SSH. The second shows the address and port your ~/.ssh/config really gives for that name, which catches a typo or an old entry. If your server uses another port, try that:
ssh -p 2222 user@203.0.113.10Causes, in order of likelihood
1. sshd is not running or not installed
For this and the next checks you need another way in: the console of your provider, or physical access.
sudo systemctl status ssh # Debian, Ubuntu
sudo systemctl status sshd # Red Hat family, most others
sudo ss -tlnp | grep -E 'sshd|:22 'If ss shows no line on the SSH port, nothing is listening. On Ubuntu the line can show systemd instead of sshd: that is ssh.socket waiting for connections, which is fine. A healthy result looks like this:
LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1,fd=6))
LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=1,fd=7))A common reason for sshd not starting is a mistake in its configuration. Check the file, then start it:
sudo sshd -t
sudo systemctl enable --now sshsshd -t prints nothing when the file is valid. If the service does not exist, install it, for example with sudo apt install openssh-server.
2. sshd listens on another port
sudo sshd -T | grep -iE '^(port|listenaddress) 'Compare the port with the one you connect to. sshd -T prints the configuration after all files are read, including anything in /etc/ssh/sshd_config.d/.
On Ubuntu 22.10 and later, sshd can be started by ssh.socket, so the listening port is set up by systemd. After changing Port, run sudo systemctl daemon-reload and sudo systemctl restart ssh.socket, then check with ss that it took effect.
3. sshd listens on another address
With ListenAddress 127.0.0.1 we got exactly this behavior: the port works from the server itself and is refused from anywhere else.
LISTEN 0 128 127.0.0.1:22 0.0.0.0:* users:(("sshd",pid=1,fd=6))Look at the local address in the ss output. 0.0.0.0 and [::] mean all addresses. A single private or loopback address means you can only connect through that address. To change it, edit or remove the ListenAddress line and restart sshd.
From outside, you can still reach it through a machine on the same network: see how to use ProxyJump and a jump host.
4. A firewall rejects the connection
A firewall rule set to reject gives the same message as a closed port. We tested this with an iptables REJECT rule while sshd was running, and ssh printed Connection refused. A rule set to drop gives a timeout instead.
sudo ufw status verbose
sudo iptables -L INPUT -n --line-numbers
sudo nft list rulesetUse the one your system has. To allow SSH with ufw:
sudo ufw allow 22/tcpIf ss looks right and local connections work, this is the most likely cause. Also check the firewall of your provider or router.
5. Your address is banned
A fail2ban ban looks exactly like this error. On a Debian 13 test server, a banned client got Connection refused from both ssh and nc. A good clue is that the server works from another network, such as a phone hotspot. Check and clear it from the server:
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip 203.0.113.20See the fail2ban guide for the setup.
6. You reach a different machine
If DNS is out of date, or a router forwards the port somewhere else, you may be asking the wrong host. Compare dig +short server with the address the provider shows. On the server, this shows whether your connection arrives at all:
sudo tcpdump -ni any 'tcp port 22'If no packet appears while you connect, the refusal comes from somewhere before this server.
Reading the results together
| From the server | From your computer | Likely cause |
|---|---|---|
No sshd line in ss | Refused | sshd is stopped or failing |
| sshd on another port | Refused on 22 | Wrong port |
sshd on 127.0.0.1 only | Refused | ListenAddress |
sshd on 0.0.0.0:22 | Refused | Firewall rejects, or a ban |
sshd on 0.0.0.0:22 | Works from another network | A ban or a block on your network |
If you are changing sshd or firewall settings on a server you reach only by SSH, keep your current session open and test with a second one before you log out.
Questions
What does Connection refused mean in SSH?
Your computer reached the address, and the machine or a firewall answered that nothing accepts connections on that port. SSH never started, so keys and passwords are not the cause.
How do I check if sshd is running?
On the server run sudo systemctl status ssh (sshd on Red Hat systems), then sudo ss -tlnp to see the addresses and ports it listens on. On Ubuntu the line can show systemd instead of sshd, which is normal.
Can fail2ban cause Connection refused?
Yes. Its default ban rejects new connections from your address. If the server works from another network, check sudo fail2ban-client status sshd.