SSH connection refused: what it means and how to fix it

Ayan Hussain

Jul 26, 2026 · 4 min read

ssh: connect to host port 22: Connection refused is the kind of error that looks alarming but usually has a straightforward explanation. The server actively rejected your connection request. That is different from a timeout, which means the server did not respond at all.

Here is how to work through it.

The most common causes

SSH is not running on the server

The daemon might be stopped or crashed. If you have another way to access the server (a web console, VNC, a physical keyboard), log in and check:

sudo systemctl status sshd

If it is not running:

sudo systemctl start sshd
sudo systemctl enable sshd

On older systems using SysV init:

sudo service ssh start

The server is listening on a non-standard port

Some administrators move SSH off port 22 to reduce automated scan traffic. Check whether the server is listening somewhere else:

sudo ss -tlnp | grep ssh

If you see port 2222 or something similar, connect with:

ssh -p 2222 user@host

Or in SSHDock, change the Port field to match.

A firewall is blocking port 22

On the server itself, check iptables or UFW:

# UFW
sudo ufw status

# iptables
sudo iptables -L -n | grep 22

If UFW is active and has no rule for port 22:

sudo ufw allow 22/tcp

If you are on a cloud provider like AWS, Google Cloud, or DigitalOcean, also check the external firewall. Security groups and VPC firewall rules sit outside the operating system. A perfectly configured server with the port blocked at the cloud level will still refuse connections.

You are connecting to the wrong IP

Check that the IP address resolves to the right server. DNS can point to old records. Run ping yourdomain.com and compare the IP to what your server's dashboard shows.

If nothing above works

Try connecting with verbose output to get more information:

ssh -vvv user@host

The output will show exactly where in the handshake things fail. Look for lines starting with debug1: or debug3: that describe what the client tried and what it got back.

Also check var/log/auth.log or /var/log/secure on the server for any log entries around the time you tried to connect. Refused connections often leave a trace there.

One thing to double-check

If this is a fresh server you just provisioned, give it 2-3 minutes. Some cloud images take time to fully boot, install the SSH daemon, and reach a ready state. Connecting within 30 seconds of launching the instance sometimes hits the daemon before it is up.

For browser-based SSH access that gives you clearer error messages and a connection log, you can use SSHDock directly in your browser without installing anything.