When you try to connect to a server via SSH, you receive:

bash
$ ssh user@192.168.1.100
ssh: connect to host 192.168.1.100 port 22: Connection refused

This error means nothing is listening on port 22, or a firewall is actively rejecting connections. Unlike a timeout (which suggests network issues), "connection refused" indicates the server received and rejected your TCP handshake.

Quick Diagnosis

First, verify you can reach the server at all:

bash
ping -c 3 192.168.1.100

If ping works but SSH fails, the issue is specifically with SSH. If ping fails, you have a network connectivity problem.

Try connecting with verbose output:

bash
ssh -v user@192.168.1.100

The output will confirm the connection refused error occurs immediately, not after authentication.

Check if SSHD is Running

Log into the server directly (console, IPMI, or through your cloud provider's web console) and check the SSH daemon status:

bash
sudo systemctl status sshd

On Ubuntu/Debian systems, the service might be called ssh:

bash
sudo systemctl status ssh

If the service is inactive or failed:

bash
sudo systemctl start sshd
sudo systemctl enable sshd

Check why it might have failed:

bash
sudo journalctl -u sshd -n 50

Common reasons sshd won't start include configuration errors:

bash
sudo sshd -t

This tests the configuration file syntax. If there's an error, it will be reported:

bash
/etc/ssh/sshd_config: line 25: Bad configuration option: PermitRootLogins
/etc/ssh/sshd_config: terminating, 1 bad configuration options

Fix any syntax errors in /etc/ssh/sshd_config and restart.

Verify SSHD is Listening

Check if sshd is actually listening on port 22:

bash
sudo netstat -tlnp | grep :22

Or using the more modern ss:

bash
sudo ss -tlnp | grep :22

Expected output:

bash
LISTEN    0    128    0.0.0.0:22    0.0.0.0:*    users:(("sshd",pid=1234,fd=3))
LISTEN    0    128    [::]:22       [::]:*       users:(("sshd",pid=1234,fd=4))

If sshd is running but not showing here, it might be configured to listen on a different port.

Check the Configured Port

Examine the SSH configuration:

bash
sudo grep -E "^Port" /etc/ssh/sshd_config

If this shows a different port:

bash
Port 2222

Connect using that port:

bash
ssh -p 2222 user@192.168.1.100

If no Port directive exists, SSH defaults to port 22. You can add it explicitly:

bash
echo "Port 22" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

Check Firewall Rules

Firewalls often block port 22. Check iptables:

bash
sudo iptables -L -n -v | grep 22

For firewalld (CentOS/RHEL/Fedora):

bash
sudo firewall-cmd --list-all

If SSH isn't listed, add it:

bash
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

For ufw (Ubuntu):

bash
sudo ufw status

Allow SSH if needed:

bash
sudo ufw allow ssh
sudo ufw reload

For iptables directly:

bash
sudo iptables -I INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Check if SSH is Bound to the Right Interface

SSHD might be listening only on localhost. Check the configuration:

bash
sudo grep -E "^ListenAddress" /etc/ssh/sshd_config

If you see:

bash
ListenAddress 127.0.0.1

SSH will only accept local connections. Either remove this line or add your external IP:

bash
# Comment out or remove the restrictive ListenAddress
sudo sed -i 's/^ListenAddress 127.0.0.1/#ListenAddress 127.0.0.1/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Check TCP Wrappers

Some systems use /etc/hosts.deny to block connections:

bash
cat /etc/hosts.deny

Look for lines like:

bash
sshd: ALL
ALL: ALL

If SSH is blocked here, comment out the lines or add an exception in /etc/hosts.allow:

bash
echo "sshd: ALL" | sudo tee -a /etc/hosts.allow

Verify from Another Machine

Test from a different network location to rule out local firewall issues:

bash
telnet 192.168.1.100 22

A successful connection shows the SSH banner:

bash
Trying 192.168.1.100...
Connected to 192.168.1.100.
Escape character is '^]'.
SSH-2.0-OpenSSH_8.9p1 Ubuntu-3

If telnet isn't available, use netcat:

bash
nc -zv 192.168.1.100 22

Check for Port Knocking

Some servers use port knocking for security. The SSH port remains closed until you "knock" on specific ports first. Check if knockd is running:

bash
sudo systemctl status knockd

If it is, you need to knock before connecting:

bash
knock 192.168.1.100 7000 8000 9000
ssh user@192.168.1.100

Resolution Checklist

  1. 1.SSHD service running: systemctl status sshd
  2. 2.SSHD listening on port 22: ss -tlnp | grep 22
  3. 3.Firewall allows port 22: firewall-cmd --list-all or ufw status
  4. 4.SSHD not restricted to localhost: check ListenAddress
  5. 5.TCP wrappers not blocking: check /etc/hosts.deny
  6. 6.Configuration syntax valid: sshd -t

Most often, the issue is simply that sshd isn't running or a firewall is blocking the port. Start with those checks first.