SSH Connection Refused on Port 22: Causes and How to Fix It

Updated: 11 October 2026 · Applies to: OpenSSH 10.2p1 on Ubuntu 26.04 LTS, 9.6p1 on Ubuntu 24.04 LTS and 9.9p1 on AlmaLinux 10 (also Debian 13 and Rocky Linux), Fail2Ban 1.1.0, PuTTY and OpenSSH Server for Windows

ssh: connect to host 203.0.113.10 port 22: Connection refused means your computer reached the server, but nothing on the server accepted a connection on port 22, or a firewall actively rejected it. The server is on and the network works. Check, in this order: is the SSH server installed and running, does it listen on port 22 (or was it moved to another port), is its configuration valid, and is a firewall or Fail2Ban rejecting your IP address. The steps below go through each one.

Refused or timed out?

We reproduced each case on test servers. The message tells you where to look:

• SSH server stopped or not installed: Connection refused
• Wrong port (22 after SSH was moved to 2222): Connection refused
• SSH listening on 127.0.0.1 only (ListenAddress 127.0.0.1): Connection refused from any other machine
• Firewall rule that rejects (ufw reject, or the nftables reject rule Fail2Ban uses on Ubuntu): Connection refused
• Firewall that drops (UFW’s default for ports you did not allow), wrong IP address or server off: Connection timed out
• SSH just restarted with a broken configuration (see step 6): first kex_exchange_identification: read: Connection reset by peer, then Connection refused

PuTTY shows Network error: Connection refused. According to the PuTTY manual, the causes are the same: the server does not offer the service on that port, or a firewall rejects the connection.

1. Check the address and port from your computer

ssh -v -p 22 root@203.0.113.10
nc -vz 203.0.113.10 22

With nothing listening on port 22, our test showed:

debug1: Connecting to 203.0.113.10 [203.0.113.10] port 22.
debug1: connect to address 203.0.113.10 port 22: Connection refused
ssh: connect to host 203.0.113.10 port 22: Connection refused

nc answers nc: connect to 203.0.113.10 port 22 (tcp) failed: Connection refused or, when the port is open, a line ending in succeeded!. Check the port in your welcome email or notes: if SSH was moved, port 22 is always refused and you connect with ssh -p 2222 (see connect to SSH on a different port).

2. Get a console on the server

You cannot fix SSH over SSH. On a Ucartz VPS, open the VNC console from the client area (access your VPS through VNC) and log in as root. On a dedicated server, use the IPMI console.

3. Is the SSH server installed and running?

sudo systemctl status ssh.socket ssh.service   # Ubuntu 24.04 and 26.04
sudo systemctl status ssh                      # Debian
sudo systemctl status sshd                     # AlmaLinux, Rocky Linux

Ubuntu 24.04 and 26.04 start SSH through socket activation: ssh.socket listens on the port and starts ssh.service when someone connects. If the socket is inactive, run sudo systemctl start ssh.socket.

Some installs, such as desktops and minimal images, have no SSH server at all; our Ubuntu 26.04 and AlmaLinux 10 test images had none. dpkg -l openssh-server then shows a line starting with un openssh-server <none>, and rpm -q openssh-server prints package openssh-server is not installed. Install it with sudo apt install openssh-server (Ubuntu, Debian) or sudo dnf install openssh-server (AlmaLinux, Rocky Linux), then check the status again.

4. Which port and address does it listen on?

$ sudo ss -tlnp | grep ':22 '
LISTEN 0  4096    0.0.0.0:22    0.0.0.0:*   users:(("systemd",pid=1,fd=113))
LISTEN 0  4096       [::]:22       [::]:*   users:(("systemd",pid=1,fd=114))

0.0.0.0 means all addresses. With socket activation, the process is shown as systemd, which is normal. To see what the configuration asks for, run sudo sshd -T | grep -E '^(port|listenaddress) '; a default install printed port 22, listenaddress [::]:22 and listenaddress 0.0.0.0:22.

5. Changed the port on Ubuntu? Restart the socket

This is easy to miss on Ubuntu 24.04 and 26.04. We set Port 2222 and restarted only the service:

$ sudo systemctl restart ssh.service
$ ss -tln | grep -E ':22 |:2222 '
LISTEN 0      4096         0.0.0.0:22         0.0.0.0:*
$ ssh -p 2222 root@127.0.0.1
ssh: connect to host 127.0.0.1 port 2222: Connection refused

The socket still listened on 22. Reload systemd and restart the socket:

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

After that, SSH listened on 2222 and port 22 was refused. On Debian and AlmaLinux, sudo systemctl restart ssh (or sshd) is enough. On AlmaLinux, the comment in /etc/ssh/sshd_config reminds you that SELinux must be told about a new port: sudo semanage port -a -t ssh_port_t -p tcp 2222. More in change the SSH port safely.

6. Check the configuration and host keys

$ sudo sshd -t
/etc/ssh/sshd_config.d/20-bad.conf line 1: unsupported option "maybe".

No output means the configuration is valid. Always run sshd -t before restarting SSH on a remote server: in our test, a restart with this error made the service fail, and after a few attempts systemd stopped the socket as well, so every connection was refused.

A server built from a cloned image, or one where /etc/ssh was cleaned up, can lack host keys. sshd then will not start: in our test, sudo sshd -t exited with the message that no host keys are available. Create them:

$ sudo ssh-keygen -A
ssh-keygen: generating new host keys: RSA ECDSA ED25519

Restart SSH afterwards. AlmaLinux and Rocky Linux create missing keys by themselves when sshd starts (the sshd-keygen units); on Ubuntu and Debian you run ssh-keygen -A. Clients that connected before then see a host key warning, explained in Remote Host Identification Has Changed.

7. Check the firewall

sudo ufw status                 # Ubuntu
sudo firewall-cmd --list-all    # AlmaLinux, Rocky Linux

On AlmaLinux 10, the default public zone lists services: cockpit dhcpv6-client ssh; if ssh (or your custom port) is missing, add it. Guides: UFW on Ubuntu and firewalld on AlmaLinux.

8. Is your IP address banned?

After repeated failed logins, Fail2Ban blocks the client’s IP address. On Ubuntu, installing Fail2Ban enables its sshd jail straight away (/etc/fail2ban/jail.d/defaults-debian.conf), and a ban is an nftables reject rule. In our lab, such a rule turned an open port 22 into Connection refused, while a drop rule gave Connection timed out. From the console or another IP address:

sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip 198.51.100.7

On cPanel servers, CSF may have blocked your IP address after failed logins: unblock an IP in CSF.

Port 22 refused on a Windows PC or server

SSH to a Windows machine is refused until the OpenSSH Server is installed and started. According to Microsoft, Windows 10 (1809 and later), Windows 11 and Windows Server 2019 and 2022 need the optional feature added; Windows Server 2025 includes it, and you enable it in Server Manager under Local Server > Remote SSH Access. In PowerShell as administrator:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'

Setup creates the firewall rule OpenSSH-Server-In-TCP for port 22, and Microsoft notes that connections are refused or reset if it is not enabled. On Linux, ssh localhost is refused for the same reason when no SSH server is installed (step 3).

GitHub: port 22 refused

If git push or ssh -T git@github.com ends with ssh: connect to host github.com port 22: Connection refused, a network between you and GitHub blocks port 22. GitHub’s documentation offers SSH over port 443 instead. Test it with ssh -T -p 443 git@ssh.github.com: from our lab, without a key, it answered git@ssh.github.com: Permission denied (publickey)., which proves the port is reachable; with your key, GitHub greets you by user name. To use port 443 for every Git command, add this to ~/.ssh/config:

Host github.com
    Hostname ssh.github.com
    Port 443
    User git

Next error?

Once the port answers, a different message means a different problem: Permission denied is a login or key issue (fix SSH permission denied), and root logins may be switched off (PermitRootLogin).

Official documentation: sshd manual and OpenSSH Server for Windows.