Fix SSH "Connection refused" / "Connection timed out"

"Connection refused" and "Connection timed out" look similar but mean very different things. Knowing which you have tells you exactly where the problem is — and how to fix it.

The two errors point to completely different problems. Match yours before you start:

If it says "Connection refused"

The server answered, but the SSH service isn't listening on that port. Through your provider's console/VNC, check the SSH daemon is running and on the expected port:

systemctl status sshd      # is it running?
systemctl start sshd       # start it if not
ss -tlnp | grep ssh        # what port is it on?

If SSH runs on a non-standard port, connect with -p:

ssh -p 2222 user@your-server-ip

If it says "Connection timed out"

Packets never reach SSH — almost always a firewall or a wrong address. Check, in order:

1. You're using the correct public IP (not an old or internal one).
2. The server's firewall allows your port (22 by default).
3. Any provider/cloud firewall or security group allows SSH.
4. The server is actually powered on (check the panel).

On the server (via console), allow SSH through the firewall:

# firewalld (CentOS/Rocky/Alma)
firewall-cmd --permanent --add-service=ssh && firewall-cmd --reload

# ufw (Ubuntu/Debian)
ufw allow 22/tcp && ufw reload

Locked out completely?

If you can't SSH in at all, use your provider's VNC / serial console from the control panel — it bypasses SSH and the network entirely, so you can fix the firewall or restart the daemon from there.

Read the exact word: "refused" is a service problem on a reachable server; "timed out" is a network or firewall problem before you ever reach it.

Other causes of "Connection refused" on a specific port

Beyond sshd being stopped: fail2ban may have banned your IP after too many failed logins (from you or someone else who tried the same public IP before you), sshd may be bound only to a specific interface/IP via ListenAddress, or SELinux can block sshd from binding to a non-default port until the port is labelled correctly with semanage port.

Other causes of "Connection timed out"

If your local firewall and the server both look fine, check for CGNAT or VPN routing on your side masking your real IP, and check the VPS/cloud provider's own network-level firewall or security group panel — a rule blocking port 22 there overrides anything you set inside the OS.

How to prevent SSH lockouts and connection errors

• Keep a console/VNC session bookmarked in your host panel for when SSH itself is unreachable.
• Never restrict SSH access by IP without a second way in (console access) as a fallback.
• Use fail2ban with a sensible, non-permanent ban time so a mistyped password doesn't lock you out for good.
• Monitor sshd with a basic healthcheck so a crashed daemon is caught before you need to connect urgently.
• Keep your firewall rules in a small script you can re-apply from the console after a lockout.

Related SSH and access errors

If SSH accepts the connection but rejects your key, see "Permission denied (publickey)". If you're being blocked after repeated attempts, read "Too many authentication failures". To lock SSH down properly once it's working, see how to harden SSH and how to install and use fail2ban.