SSH Connection Refused on a VPS
Connection refused means the server answered with a TCP reset: the host is reachable but nothing is listening on that port. Check sshd, then the Port line in sshd_config, then UFW or iptables, then fail2ban. A timeout instead of a refusal means packets are dropped — a network problem.
For VPS owners locked out by a refused SSH connection, in the order the causes actually occur.
knowledge
- Read time
- 5 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What "connection refused" actually means on a VPS
"Connection refused" means the server was reachable and answered with a TCP reset — something decided there is no service listening on the port you dialled. That is a narrower problem than it sounds, and separating it from the two errors people confuse it with saves the most time.
| Message | What happened | Look at first |
|---|---|---|
| Connection refused | Host answered with a reset; nothing is listening on the port | sshd service, Port setting, local firewall, fail2ban |
| Connection timed out | No answer; packets dropped or the host is down | IP address, provider security group, host status |
| Permission denied (publickey) | SSH reached the daemon but authentication failed | Key, username, sshd_config authentication rules |
Refused is a service or port problem; timeout is a network or provider problem; permission denied is a credential problem. This guide works the first column, in the order the causes actually occur.
Check the address and the port before changing anything
Confirm the IP and the port first, because most refusals after a rebuild or migration are simply the old IP or an old port saved in the SSH client. Four checks, two minutes, no configuration touched.
- Ping the host:
ping -c 4 YOUR.SERVER.IP. Some providers block ICMP, so a silent ping is not proof of a dead server. - Test the port directly:
nc -vz YOUR.SERVER.IP 22. A refusal here matches what SSH reports; an open result means the problem is authentication, not the network. - Watch the negotiation:
ssh -vvv user@YOUR.SERVER.IPprints the port it tried and where it stopped. - Read the provider panel: some hosts expose SSH on a non-standard port for managed access — copy both IP and port from there.
On Windows, PuTTY shows the same "connection refused" for the same causes: fill Host Name with the IP, Port with the panel's port, and read the connection log before changing settings. If you have never generated a key pair for the machine, the SSH key guide for Ubuntu covers that side.
Is sshd running and listening?
Two commands answer this: one says whether the service is active, the other whether it is actually listening — and the second is the one that matters. A service can be "active" yet bound to nothing.
sudo systemctl status ssh
sudo ss -tlnp | grep -E ':22|:2222'
sudo journalctl -u ssh -n 50 --no-pagerA healthy output shows LISTEN on 0.0.0.0:22 or [::]:22 next to sshd. If the service is active but nothing listens, the daemon failed to bind: another process took the port, the config names a different Port, or ListenAddress points at an address the server no longer holds — the OpenSSH manual documents both directives with 22 as the Port default. On RHEL, AlmaLinux and Rocky the unit is sshd, not ssh: start and enable it with sudo systemctl enable --now sshd, then read the journal again if it exits immediately.
The firewall can refuse you from three places
A VPS can run three firewalls at once — UFW or firewalld inside the OS, raw iptables or nftables rules, and the provider's security group outside the machine — and a port open in one can still be closed in another. Check all three before assuming sshd is broken.
- OS firewall:
sudo ufw status verboseshows the Ubuntu rules;sudo ufw allow 22/tcpthensudo ufw reloadopens the port. - Raw rules:
sudo iptables -L -n --line-numbers— look for REJECT or DROP sitting above any ACCEPT for your port; order matters. - Provider firewall: the panel's security group needs its own inbound rule for TCP 22, or your custom port, ideally scoped to your IP.
- Docker: Docker inserts its own iptables chains, so a container publishing a port can bypass UFW — which is why the rules look right and the port still refuses.
Do not start by flushing every rule. Add the ACCEPT rule you need, confirm the login works, and only then tidy the rest — a blind flush can expose services that were deliberately closed.
Wrong port, AllowUsers and fail2ban bans
Three configuration mistakes produce a refusal even when sshd is healthy: a changed Port, an AllowUsers list that excludes you, and a fail2ban ban on your IP. Work them in that order, and always keep your current session open while you restart the service.
- Read the active Port line in
/etc/ssh/sshd_config; a commented#Port 22means the default 22 still applies. - Test before restarting:
sudo sshd -tchecks the config's validity ("test mode" in the sshd manual). A syntax error here is how a working server becomes unreachable. - Restart safely: with one session still open,
sudo systemctl restart ssh, then test from a second session — if the second fails, the first can undo the change. - Check fail2ban:
sudo fail2ban-client status sshd; if your IP is listed,sudo fail2ban-client set sshd unbanip YOUR.IP. - Whitelist yourself: add your office or admin IP under
ignoreipin/etc/fail2ban/jail.localso one typo cannot lock you out again.
If the panel shows a custom SSH port, the client needs ssh -p PORT user@IP — and the firewall needs that port, not 22.
Recovery from the provider console when SSH is already down
When no login works, stop editing blind and use the provider's VNC console, serial console or rescue mode, which reaches the machine without SSH. The journal almost always names the exact line that broke.
- Open the console from the VPS panel and log in as root with the provider password.
- Read the journal:
journalctl -u ssh -n 100 --no-pager. - Fix sshd_config, run
sshd -t, then restart the service. - In rescue mode, mount the disk read-write, edit the file from the mounted root, unmount, boot normally.
- Test from outside with
nc -vz IP 22before closing the console.
Take a snapshot before rescue-mode surgery if the panel offers one. The sudo user guide covers creating a second admin account — the cheapest insurance against a lockout.
Prevent the next SSH lockout
Most lockouts are self-inflicted during a hardening change, and four habits remove almost all of them. Keep a second admin user with sudo and a tested key; allow both the old and new SSH port for a week when you change ports; whitelist your admin IP in fail2ban and the provider firewall before tightening anything; and watch the port with an external uptime check so a closed port is an alert, not a 2 a.m. surprise.
If the server is a WebJi® VPS, the panel console and rescue options are part of the service, and support at support@webji.services can read the journal with you — email is answered 24/7 in Hindi and English, average first reply under 60 minutes. For host-level firewall policy on cPanel machines, the CSF firewall guide covers the ConfigServer side, and SSH two-factor authentication is the next hardening step once you are back in.
Frequently asked questions
Why is my SSH connection refused?
The port you dialled has nothing accepting connections. In order of frequency: sshd is stopped, it listens on a different port after a config change, UFW or iptables rejects 22, the provider security group blocks it, or fail2ban banned your IP. Run the checks in that order.
What is the difference between connection refused and connection timed out?
Refused means the host answered with a TCP reset — it is reachable but nothing is listening on that port. Timed out means no answer at all, which points to a dropped packet, a wrong IP, a security group or a down host rather than a stopped service.
How do I check whether SSH is running?
Run systemctl status ssh on Ubuntu or Debian, or systemctl status sshd on RHEL-family systems. Then run ss -tlnp | grep :22 to see whether it is actually listening, and journalctl -u ssh -n 50 for the reason it stopped.
Can fail2ban lock me out of my VPS?
Yes. Repeated failed logins add your IP to the ban list and the connection is refused until the bantime expires. From the provider console run fail2ban-client status sshd to see the list, then fail2ban-client set sshd unbanip YOUR.IP, and add your IP to ignoreip so it does not repeat.
How do I fix SSH refused after a firewall change?
Get in through the provider console, run iptables -L -n and ufw status to find the rejecting rule, and add an ACCEPT rule for your port before removing anything. Do not flush every rule first — that can open the server wider than it was.
Last editorial update: 15 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.