Why does SSH return connection refused?
Connection refused normally indicates that the destination rejected the TCP connection, often because nothing is listening on that port. It differs from a silent timeout, although a rejecting firewall can produce a similar result.
Instructions
1. Check the client port and endpoint
Make sure the command uses the assigned SSH port and the current server IP.
Test-NetConnection 203.0.113.10 -Port 22Use the configured port instead of 22 when different. A failed result alone does not identify which component rejected it.
2. Inspect the listener through independent access
Use the provider console or another authorised working session. Do not run this in local Windows.
sudo ss -lntp 'sport = :22'This checks listening TCP sockets for port 22 and their owning process. Use the real SSH port.
3. Inspect the distribution-specific service
On Ubuntu or Debian, ssh.service and possibly ssh.socket are relevant. RHEL-family installations commonly use sshd.service. Inspect status and recent logs before starting or reconfiguring anything.
systemctl status ssh.service ssh.socket --no-pagerThis example is for Ubuntu or Debian systemd hosts. A missing socket unit can be normal; do not assume all releases use socket activation.
Check the result
- A listener exists on the assigned address and port.
- The external client progresses to SSH host verification or authentication.
Troubleshooting
- The service listens on a different port
- Use the configured port or follow an approved change procedure; do not reset it blindly.
- The service is active but no listener appears
- Check unit logs, socket activation and bind-address settings through the authorised console.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.