How to Fix SSH Connection Refused on a Linux VPS

SSH (Secure Shell) is one of the most common ways to manage a Linux VPS remotely. It allows you to execute commands, manage files, install software, and troubleshoot server issues without accessing the server physically.

However, when you try to connect to your VPS and receive the error “Connection refused,” you may be unable to access your server through SSH.

This error usually means that your VPS is reachable, but the connection is being rejected because the SSH service is not listening on the expected port, a firewall is blocking access, or the SSH configuration is incorrect.

In this guide, we will explain how to diagnose and fix SSH connection refused errors on a Linux VPS.

What Does “SSH Connection Refused” Mean?

An SSH connection refused error commonly appears in a terminal like this:

ssh: connect to host 192.0.2.10 port 22: Connection refused

The IP address above is an example. Replace it with your VPS’s actual IP address.

Unlike a connection timeout, which often indicates a network or filtering issue, a connection refused error generally means the destination actively rejected the connection. A firewall rule or network device can also cause this behavior.

Common causes include:

• The SSH service is stopped or has failed.
• SSH is listening on a different port.
• The server firewall is rejecting connections.
• A provider-level firewall is blocking the SSH port.
• The SSH daemon configuration contains an error.
• The VPS has recently rebooted or experienced a system issue.

1. Check the VPS IP Address and SSH Port

Before changing server settings, confirm that you are connecting to the correct IP address and port.

The default SSH port is 22, but some servers use a custom port.

Connect using the default port:

ssh username@YOUR_SERVER_IP

If your SSH service uses a custom port, specify it with -p:

ssh -p 2222 username@YOUR_SERVER_IP

Replace username with your Linux account name, YOUR_SERVER_IP with your VPS IP address, and 2222 with your actual SSH port.

If you are unsure which port is configured, access the VPS through your hosting provider’s web console or another available console method and inspect the SSH configuration.

2. Check Whether the SSH Service Is Running

One of the most common causes of a refused connection is a stopped SSH service.

Access your VPS through its console and check the service status.

For Ubuntu and Debian:

sudo systemctl status ssh

For many AlmaLinux, Rocky Linux, CentOS, and other RHEL-based systems:

sudo systemctl status sshd

If the service is inactive or stopped, start it using the appropriate service name.

Ubuntu and Debian:

sudo systemctl start ssh

RHEL-based systems:

sudo systemctl start sshd

To start the service automatically after a reboot, run:

sudo systemctl enable ssh

On systems that use sshd as the service name, use sudo systemctl enable sshd instead.

Check the service status again after starting it. If the service fails to start, review the logs before making further changes.

3. Check Whether SSH Is Listening on Port 22

Even if the SSH service is running, it might not be listening on the port you expect.

Run:

sudo ss -lntp | grep ssh

This command displays listening TCP sockets associated with SSH. You may see output similar to:

LISTEN 0 128 0.0.0.0:22 0.0.0.0:*

In this example, SSH is listening on port 22 on all IPv4 interfaces.

If the command returns no output, check the service status, configuration, and logs.

If SSH is listening on a different port, connect using that port. If it is listening only on a specific IP address, confirm that the address is appropriate for your VPS network configuration.

4. Check the Linux Firewall

A firewall can prevent incoming SSH connections. The commands you should use depend on the firewall software installed on your server.

Check UFW on Ubuntu

Check whether UFW is active:

sudo ufw status verbose

If SSH uses port 22, allow incoming SSH connections:

sudo ufw allow 22/tcp

If you use a custom port, such as 2222, allow that port instead:

sudo ufw allow 2222/tcp

Verify the rules afterward:

sudo ufw status numbered

Important: Before enabling UFW on a server where it is inactive, confirm that your required management ports are allowed. Otherwise, you could block SSH or other services you need.

Check firewalld on AlmaLinux or Rocky Linux

Check the firewall status:

sudo firewall-cmd --state

If firewalld is active and SSH uses port 22, allow the SSH service:

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

For a custom port, add the appropriate TCP port instead:

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

Replace 2222 with your configured SSH port. Only allow the port you actually need.

Check Other Firewall Rules

If UFW or firewalld is not being used, inspect the server’s existing firewall configuration. Avoid flushing firewall rules or disabling the firewall entirely as a troubleshooting shortcut, especially on a production server.

5. Check Your VPS Provider’s Firewall

Some VPS providers offer an additional firewall or network security group outside the operating system.

Even if the Linux firewall allows SSH, an external rule may still block incoming connections.

Log in to your VPS provider’s control panel and check:

• Whether a network firewall is enabled.
• Whether inbound TCP traffic is allowed on the SSH port.
• Whether the rule applies to the correct VPS IP address.
• Whether your current public IP address is permitted by any source-IP restriction.

If you use a custom SSH port, make sure the external firewall allows that port instead of only allowing port 22.

If the provider offers a web-based console, use it to inspect the server while troubleshooting.

6. Verify the SSH Configuration

Incorrect SSH configuration can prevent the daemon from starting or cause it to listen on an unexpected port.

The primary configuration file is usually:

/etc/ssh/sshd_config

Open it using a text editor:

sudo nano /etc/ssh/sshd_config

Check the Port directive and any relevant ListenAddress directives. For example:

Port 22

A line beginning with # is generally a comment and is not an active setting. Also, included configuration files may affect the final configuration.

Before restarting SSH, validate the configuration:

sudo sshd -t

If this command returns an error, fix the reported configuration issue first. If the sshd command is not found, use its full path or check the installed OpenSSH server package.

After the configuration passes validation, restart the appropriate service:

sudo systemctl restart ssh

On systems using the sshd service name:

sudo systemctl restart sshd

Security tip: Keep your existing console or SSH session open while changing SSH settings. If you are changing ports or authentication settings, test a second connection before closing the working session.

7. Review SSH Service Logs

If SSH refuses connections after you start the service, logs can help identify the underlying issue.

On Ubuntu and Debian:

sudo journalctl -u ssh -n 100 --no-pager

On systems using the sshd service:

sudo journalctl -u sshd -n 100 --no-pager

To inspect recent system messages, you can also run:

sudo journalctl -p warning -b --no-pager

Look for messages related to configuration errors, missing host keys, permission problems, or failed service startup.

The exact log message will help determine the next step instead of repeatedly restarting the service without identifying the cause.

8. Test the Connection From Your Computer

After checking the service, port, and firewall, test SSH again from your local computer.

ssh -v username@YOUR_SERVER_IP

The -v option displays verbose connection information, which can help identify where the connection fails.

For a custom SSH port:

ssh -v -p 2222 username@YOUR_SERVER_IP

You can also test whether a TCP port is reachable using netcat, if it is installed:

nc -vz YOUR_SERVER_IP 22

Replace 22 with your actual SSH port.

Interpret the result carefully:

• Connection refused: The port is rejecting connections, often because no service is listening or a firewall is actively rejecting traffic.
• Connection timed out: The traffic may be silently filtered, routed incorrectly, or blocked by a network firewall.
• Permission denied: The SSH service is reachable, but authentication has failed. Check the username, credentials, SSH keys, and authentication settings.

These errors require different troubleshooting steps, so identify the exact message before making changes.

9. What If SSH Still Does Not Work?

If you have checked the SSH service, configuration, port, and firewalls but cannot connect, investigate the wider server environment.

Consider these possibilities:

• The VPS is experiencing a boot or operating system issue.
• The server has exhausted critical system resources.
• The network interface or routing configuration is incorrect.
• The SSH server package is missing or damaged.
• A security tool or automated blocking rule is rejecting your IP address.

Use your provider’s console to inspect the operating system and network status. If the VPS itself is unreachable or fails to boot, contact your provider’s technical support for further investigation.

For production servers, avoid reinstalling the operating system or resetting firewall rules before checking the available recovery options and making sure you have a backup.

Need a Reliable VPS for Your Projects?

Reliable server access is essential when managing websites, applications, databases, and other online services. Choosing a VPS that fits your workload and keeping its SSH configuration secure can make day-to-day server administration easier.

Explore the available VPS options from ServerNext:

• USA VPS Server
• BDIX VPS Server
• Singapore VPS Server
• Germany NVMe VPS Server
• Offshore VPS Server

Visit ServerNext to explore the available server solutions for your requirements.

Disclaimer: Commands and service names can vary by Linux distribution and server configuration. Review your current settings before changing firewall or SSH rules.