How to Fix SSH Connection Refused

Trying to connect to your Ubuntu server, only to receive an error saying Connection refused? It can be frustrating, especially when you need to access your server to manage a website, deploy an application, or troubleshoot a production issue.

The SSH connection refused error usually means your computer can reach the target server, but the server is not accepting connections on the requested SSH port. This often happens because the SSH service is not running, the server is listening on a different port, or a firewall is actively rejecting the connection.

The good news is that you usually don’t need to reinstall OpenSSH or rebuild your server to fix it.

In this guide, I’ll walk through several practical ways to troubleshoot and fix SSH connection refused errors on Ubuntu, including Ubuntu 24.04. We’ll start with the most common causes and move toward more detailed checks if the problem persists.

What Does SSH Connection Refused Mean?

When you connect to a server using SSH, your SSH client attempts to establish a TCP connection to the destination server, usually through port 22.

For example:

ssh [email protected]

If the connection is rejected, you may see an error similar to this:

ssh: connect to host 192.168.1.100 port 22: Connection refused

This error is different from an authentication failure. Your connection has not reached the stage where SSH checks your password or private key.

In most cases, one of the following issues is responsible:

• The OpenSSH server is not running.
• The SSH service is not installed.
• SSH is listening on a different port.
• The server’s SSH configuration contains an error.
• A firewall is rejecting incoming connections.
• The server is listening only on localhost or an incorrect IP address.
• A cloud firewall or network configuration is blocking or redirecting traffic.

Understanding the difference helps you avoid wasting time changing SSH keys or passwords when the actual problem is network connectivity.

1. Check Whether the SSH Service Is Running

The first thing I usually check is the SSH service itself.

If the OpenSSH server is stopped, your server cannot accept incoming SSH connections.

Access your Ubuntu server through your VPS provider’s web console, VNC, or another available management console.

Then run:

sudo systemctl status ssh

Look for the service status.

If you see:

Active: active (running)

The SSH service is running.

However, if the output shows:

Active: inactive (dead)

or:

Active: failed

You need to investigate why the service is not accepting connections.

On Ubuntu, you can try starting the service with:

sudo systemctl start ssh

To make sure it starts automatically when the server boots:

sudo systemctl enable ssh

Check the status again:

sudo systemctl status ssh

A note for Ubuntu 24.04: Ubuntu uses systemd socket activation for SSH by default on supported installations. In this configuration, ssh.socket may be listening for incoming connections and starting ssh.service when needed. Therefore, an inactive ssh.service does not automatically mean SSH is broken.

Check both units:

sudo systemctl status ssh.service ssh.socket

If socket activation is enabled, make sure ssh.socket is active.

2. Verify That SSH Is Listening on Port 22

Even when the SSH service appears to be running, it doesn’t necessarily mean that it is listening on the port you expect.

You can verify listening ports using the ss command:

sudo ss -tlnp | grep ssh

Alternatively, check port 22 directly:

sudo ss -tlnp | grep ':22'

A typical result looks similar to this:

LISTEN 0 4096 0.0.0.0:22 0.0.0.0:*
LISTEN 0 4096 [::]:22 [::]:*

This indicates that the server is listening on port 22 for IPv4 and IPv6 connections.

If you don’t see port 22, SSH may be configured to use another port.

Check the effective SSH configuration:

sudo sshd -T | grep '^port'

For example, the output might show:

port 2222

In that case, your SSH client must use port 2222 instead of the default port:

ssh -p 2222 username@your-server-ip

Always make sure the port configured on the server matches the port used by your SSH client.

3. Check the SSH Server Configuration

An incorrect SSH configuration can prevent the SSH daemon from starting properly or listening on the expected network interface.

The main configuration file is:

/etc/ssh/sshd_config

Open it using your preferred text editor:

sudo nano /etc/ssh/sshd_config

Look for these configuration directives:

Port 22
ListenAddress 0.0.0.0

The Port directive defines which TCP port SSH uses.

The ListenAddress directive controls which network addresses SSH listens on.

For example, if SSH is configured with:

ListenAddress 127.0.0.1

It will only accept connections through the local loopback interface. Remote clients won’t be able to connect through the server’s public IP.

Before restarting SSH, validate the configuration:

sudo sshd -t

If the command returns no output, the configuration syntax is valid.

If it reports an error, review the indicated line and correct it before proceeding.

You should also check additional configuration files under:

/etc/ssh/sshd_config.d/

Ubuntu may load additional SSH settings from this directory.

Important: Ubuntu 24.04 uses socket activation by default. If you change the SSH port or listening address, systemd may also need to reload the socket configuration.

For a valid configuration change, you can run:

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

If your installation uses the traditional SSH service instead, restart that service:

sudo systemctl restart ssh

Don’t restart services blindly if you’re connected remotely. Keep your existing console session open until you confirm that the new configuration works.

4. Check Ubuntu Firewall Rules

Another common reason for SSH connection refused is a firewall rule that rejects incoming SSH traffic.

Ubuntu commonly uses UFW (Uncomplicated Firewall) to manage firewall rules.

First, check its current status:

sudo ufw status verbose

If UFW is active, look for a rule allowing SSH connections.

For the default SSH port, you can allow incoming connections using:

sudo ufw allow OpenSSH

Alternatively, allow port 22 directly:

sudo ufw allow 22/tcp

If you’re using a custom SSH port, replace 22 with the correct port.

For example:

sudo ufw allow 2222/tcp

Check the firewall rules again:

sudo ufw status numbered

Make sure the required SSH port is allowed before attempting another connection.

Avoid disabling the entire firewall just to troubleshoot SSH. It’s better to identify and correct the specific rule that’s causing the problem.

5. Check Your VPS or Cloud Firewall

This is something that’s easy to overlook.

Even when SSH is running correctly and UFW allows port 22, external connections can still fail because of firewall rules configured outside the operating system.

Many VPS and cloud providers have an additional network firewall layer.

Depending on your provider, it may be called:

• Security Group
• Cloud Firewall
• Network ACL
• Inbound Firewall Rules

Check whether the server allows incoming TCP traffic on your SSH port.

For example, your firewall might need a rule similar to this:

Protocol: TCP
Port: 22
Source: Your Public IP Address
Action: Allow

If you’re using a custom SSH port, make sure the firewall rule matches that port.

It’s also worth checking whether your public IP address has changed. Some firewall configurations only allow connections from specific source IP addresses.

For security reasons, avoid opening SSH access to everyone unless you have a specific reason to do so.

6. Check SSH Logs for More Details

If the previous steps don’t solve the problem, checking system logs can help identify the underlying issue.

Ubuntu uses systemd journal logs to record service events.

Run:

sudo journalctl -u ssh.service -u ssh.socket -n 100 --no-pager

This displays the latest SSH service and socket-related messages.

You can also check the authentication log:

sudo tail -f /var/log/auth.log

Look for errors related to:

• Invalid SSH configuration.
• Failed service startup.
• Port binding problems.
• Permission issues.
• Unexpected SSH daemon termination.

If the service fails to start, the logs often provide a much better explanation than the generic connection refused message.

For additional troubleshooting, you can also run:

sudo sshd -t

This is particularly useful after editing SSH configuration files.

7. Restart SSH and Test the Connection Again

After identifying and fixing the issue, restart the appropriate SSH component.

For systems using the traditional service:

sudo systemctl restart ssh

For Ubuntu installations using socket activation, if you’ve changed socket-related settings:

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

Verify that SSH is listening on the expected port:

sudo ss -tlnp | grep ssh

Now return to your local computer and try connecting again:

ssh username@your-server-ip

If you’re using a custom SSH port:

ssh -p 2222 username@your-server-ip

You can also enable verbose output to get more information about the connection attempt:

ssh -vvv username@your-server-ip

This is useful when the issue isn’t immediately obvious.

A Practical Troubleshooting Scenario

When managing Linux servers, I’ve learned that a running VPS doesn’t necessarily mean every service inside it is available.

Imagine checking a server through your provider’s dashboard and seeing that the VPS is running normally. CPU and memory usage look fine, but every SSH connection attempt returns:

ssh: connect to host example.com port 22: Connection refused

My first instinct would be to check the network, but I’d avoid changing firewall rules immediately.

Instead, I’d open the provider’s console and check whether the SSH service is active. If the service looks healthy, the next step is to inspect listening ports using ss.

This simple check can reveal that SSH is actually listening on a different port than expected.

Another possibility is that a recent configuration change caused the SSH socket to listen on the wrong address or port.

Once the listening configuration matches the firewall rules and the SSH client uses the correct port, the connection should work again.

The important lesson is to troubleshoot from the service outward: verify the SSH process, confirm the listening port, inspect firewall rules, and then investigate the external network path.

It saves time and reduces the risk of making unnecessary changes to a working server.

SSH Connection Refused vs. Connection Timed Out

These two errors are often confused, but they don’t indicate exactly the same problem.

Error	What It Usually Means
Connection refused	The connection was actively rejected, often because nothing is listening on the requested port.
Connection timed out	No response arrived within the expected time, often because traffic is being dropped or cannot reach the destination.
Permission denied	The SSH connection reached the authentication stage, but the supplied credentials or key were rejected.

Understanding these differences helps narrow down the troubleshooting process.

For example, if you receive Permission denied (publickey), there’s little reason to investigate whether port 22 is listening. The problem is now related to SSH authentication.

Frequently Asked Questions

1. Why does SSH say connection refused?

This usually happens when the SSH server isn’t accepting connections on the requested port. Common causes include a stopped SSH service, incorrect port configuration, or firewall rules rejecting incoming traffic.

2. How do I restart SSH on Ubuntu?

Run sudo systemctl restart ssh to restart the SSH service. On Ubuntu systems using socket activation, you may also need to check and restart ssh.socket depending on the configuration changes.

3. How do I check whether SSH is listening on port 22?

Run sudo ss -tlnp | grep ':22' on the server. If SSH is listening on the default port, the command should display a listening TCP socket.

4. Can a firewall cause SSH connection refused?

Yes. A firewall can actively reject incoming SSH connections. Check UFW rules and any external firewall or security group configured by your hosting provider.

5. Is SSH connection refused the same as permission denied?

No. Connection refused happens before SSH authentication begins. Permission denied means the server accepted the connection but rejected the authentication attempt.

6. Why does SSH connection refused happen after changing the SSH port?

The SSH server, systemd socket, firewall, and SSH client may no longer be using the same port. Verify the effective configuration and listening socket, then make sure all firewall rules and connection commands use the correct port.

Final Thoughts

An SSH connection refused error doesn’t necessarily mean your Ubuntu server has a serious problem.

In many cases, the issue comes down to a stopped SSH service, an incorrect listening port, or a firewall rule rejecting incoming traffic.

The best approach is to troubleshoot systematically rather than reinstalling OpenSSH or changing multiple configurations at once.

Start by checking the SSH service, verify the listening port, inspect your firewall rules, and review the system logs if necessary.

Once you understand where the connection is being rejected, fixing the problem becomes much easier.

If you regularly manage Ubuntu servers, keeping these troubleshooting commands handy can save you quite a bit of time the next time SSH stops accepting connections.