SSH Connection Refused on Port 22 – Quick Fix

When You See This Error

You type ssh user@192.168.1.100 and get ssh: connect to host 192.168.1.100 port 22: Connection refused. No prompt, no password challenge — just a dead connection. This usually happens after a reboot, a failed security update, or when someone (maybe you) accidentally stopped the SSH service. I've seen it most often on freshly installed Ubuntu 22.04 servers that never had SSH enabled, or on CentOS 7 boxes after a firewall rule reset.

Root Cause

Plain and simple: the OpenSSH daemon (sshd) isn't listening on port 22. Two reasons cover 95% of cases:

1. SSH service is stopped or crashed. Might've been disabled at boot, or a config typo made it fail to start.
2. A firewall is blocking port 22. iptables, ufw, or firewalld dropping incoming traffic.

Less common: someone changed the SSH port in /etc/ssh/sshd_config and forgot to tell you. Check that if the usual fixes don't work.

Fix in 4 Steps

Run these on the machine you're trying to SSH into. You'll need local access — physical console, IPMI, or out-of-band management.

Step 1: Check If SSHD Is Running

sudo systemctl status sshd

Look for Active: active (running). If it says inactive (dead) or failed, move to Step 2. If it's running, the problem is almost certainly your firewall — jump to Step 3.

Step 2: Start and Enable the SSH Service

sudo systemctl start sshd
sudo systemctl enable sshd

start fires it up now. enable makes it survive reboots. If it fails to start, run:

sudo journalctl -u sshd -n 20

This shows the last 20 log lines. Common errors: bad config line in /etc/ssh/sshd_config (like a typo in PermitRootLogin), or a missing host key. Fix the config, then try sudo systemctl restart sshd.

Step 3: Check Your Firewall

Even with SSHD running, a firewall can silently drop packets. Check what's in use:

sudo ufw status

If it shows Status: active and port 22 isn't in the list, run:

sudo ufw allow 22/tcp

For firewalld (RHEL/CentOS 7+):

sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --reload

For old-school iptables:

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo service iptables save  # if using iptables-services

Test the firewall by running SSH from another machine. If it works, you're done. If not, check if your firewall has a DROP rule on port 22 or if there's a cloud security group blocking it (AWS, Azure, GCP — check their portal).

Step 4: Verify SSHD Is Listening

sudo netstat -tlnp | grep :22

You should see something like:

tcp  0  0 0.0.0.0:22  0.0.0.0:*  LISTEN  1234/sshd

If you see 127.0.0.1:22 instead of 0.0.0.0:22, SSHD is only binding to localhost. Check /etc/ssh/sshd_config for a ListenAddress 127.0.0.1 line — comment it out or change it to 0.0.0.0, then restart.

Still Failing?

Three things to check next:

• Is port 22 open on your router? If you're SSHing from outside your LAN, you need port forwarding. That's a network config issue, not a Linux one.
• Is SELinux or AppArmor blocking it? Check sudo ausearch -m avc -ts recent for SELinux denials. Temp fix: sudo setenforce 0. Real fix: update SELinux policy.
• Did you change the SSH port? Try ssh -p 2222 user@host if you've set a custom port. Check /etc/ssh/sshd_config for Port.

One last thing: if you're on a cloud instance (AWS EC2, DigitalOcean Droplet, etc.), the security group or firewall in the cloud console might block port 22. Go check there — it'll override anything local. Saved me more times than I'd like to admit.