How to Fix ‘SSH Connection Refused (Port 22)’ in Linux

Attempting to connect to a remote Linux server or local development virtual machine only for your terminal to output the immediate rejection: “ssh: connect to host 192.168.1.100 port 22: Connection refused” halts administration workflows. Unlike network timeouts (which typically indicate dropped packets or routing blackholes), a Connection refused message is an explicit TCP RST (reset) response sent back by the target host or an intervening firewall. This response confirms that the server network stack received the TCP SYN packet, but either no service is currently listening on port 22 or firewall rules actively reject the connection. This tutorial explains how to diagnose SSH daemon state, inspect listening sockets, and adjust firewall policies in Linux.

Why Does Linux Return ‘Connection Refused’ on Port 22?

Understanding the exact failure point between the SSH client and the host daemon speeds up recovery:

• OpenSSH Daemon Is Inactive or Failed: The sshd system service is not running, crashed during startup, or was never installed on a clean minimal OS image.
• Custom Port Configuration: The server’s sshd_config was modified to listen on a non-standard port (such as 2222 or 50222), causing default port 22 queries to be rejected.
• Local Firewall Rules (UFW / firewalld / iptables): Uncomplicated Firewall (UFW) or iptables filtering configured with an explicit REJECT target for incoming connections.
• IP Address or Network Interface Binding Restrictions: The SSH daemon is configured to listen exclusively on the loopback interface (127.0.0.1) rather than all available network adapters (0.0.0.0).

Step 1: Check OpenSSH Server Service Status

Log in via the server console, cloud provider VNC viewer, or local terminal to verify that the daemon is active.

1. Check the status of the SSH service:

   sudo systemctl status ssh

   (Note: On RHEL, CentOS, or Fedora, use sudo systemctl status sshd).
2. If the service is marked as inactive (dead) or failed, start it immediately:

   sudo systemctl start ssh
   sudo systemctl enable ssh

3. If the system reports “Unit ssh.service could not be found”, the OpenSSH server package is not installed. Install it using your distribution package manager:

   sudo apt update && sudo apt install -y openssh-server

Step 2: Verify Listening Ports and Address Binding

Confirm that the SSH service is actively listening on TCP port 22 and bound to public interfaces.

1. Use ss to inspect active TCP listening sockets:

   sudo ss -tulpn | grep -E ':(22|ssh)'

2. Inspect the output address:
   • If it displays 0.0.0.0:22 and [::]:22, the daemon is properly listening on all IPv4 and IPv6 interfaces.
   • If it displays 127.0.0.1:22, the daemon is restricted to local connections only.
   • If another port number is listed (e.g. 0.0.0.0:2222), connect from your client using the -p flag: ssh -p 2222 user@host.
3. To correct interface binding, edit the configuration file:

   sudo nano /etc/ssh/sshd_config

4. Locate the line #ListenAddress 0.0.0.0, uncomment it by removing the #, and ensure Port 22 is declared.
5. Save the file (Ctrl + O, then Ctrl + X) and restart the daemon:

   sudo systemctl restart ssh

Step 3: Configure UFW and firewalld Firewall Rules

Adjust local firewall policies to allow incoming TCP traffic on port 22.

1. For Ubuntu and Debian (UFW):

   sudo ufw status verbose
   sudo ufw allow 22/tcp
   sudo ufw reload

2. For RHEL, AlmaLinux, and Rocky Linux (firewalld):

   sudo firewall-cmd --permanent --add-service=ssh
   sudo firewall-cmd --reload

3. For Raw iptables:

   sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Step 4: Test Connection Verbosity from the Client

Run SSH with verbose output from your client machine to pinpoint the exact network layer dropping the connection.

1. Execute SSH with the -vvv switch:

   ssh -vvv [email protected]

2. Analyze the output lines:
   • If it halts at Connecting to 192.168.1.100 [192.168.1.100] port 22... followed by connect to host ... port 22: Connection refused, the host machine actively rejected the TCP SYN packet.
   • If it passes the connection stage and displays Connection established, the issue was with authentication credentials rather than network connectivity.

Troubleshooting Summary for SSH Connection Refused

Diagnostic Check	Terminal Command	Expected Resolution
Verify Daemon Status	systemctl status ssh	Starts and enables inactive OpenSSH server daemon
Check Socket Bindings	ss -tulpn | grep 22	Ensures daemon listens on 0.0.0.0:22
Open UFW Firewall	ufw allow 22/tcp	Permits inbound TCP handshakes through packet filter
Inspect Verbose Logs	ssh -vvv user@host	Pinpoints exact handshake stage of connection refusal

Following these systematic verification steps ensures that OpenSSH is active, correctly bound, and accessible through firewall rules across any Linux server environment.