"Connection refused" and "Connection timed out" look similar but mean very different things. Knowing which you have tells you exactly where the problem is — and how to fix it.
Quick answer
SSH "Connection refused" means you reached the server but nothing is listening on that port — sshd is stopped or running on a different port. "Connection timed out" means you never reached it, usually a firewall, the wrong IP or a server that is down. For refused, start sshd and check the port; for a timeout, check the firewall and the address.
Connection refused = you reached the server but nothing is listening on the port (SSH down/wrong port). Connection timed out = you never reached it at all (firewall, wrong IP, or the host is offline).
The two errors point to completely different problems. Match yours before you start:
| Error | What it means | Most likely cause | First check |
|---|---|---|---|
| Connection refused | Server reached, port not listening | SSH daemon down or wrong port | systemctl status sshd |
| Connection timed out | Nothing reached the server at all | Firewall / wrong IP / host offline | The firewall and the IP you used |
If it says "Connection refused"
The server answered, but the SSH service isn't listening on that port. Through your provider's console/VNC, check the SSH daemon is running and on the expected port:
systemctl status sshd # is it running?
systemctl start sshd # start it if not
ss -tlnp | grep ssh # what port is it on?If SSH runs on a non-standard port, connect with -p:
ssh -p 2222 user@your-server-ipIf it says "Connection timed out"
Packets never reach SSH — almost always a firewall or a wrong address. Check, in order:
- You're using the correct public IP (not an old or internal one).
- The server's firewall allows your port (22 by default).
- Any provider/cloud firewall or security group allows SSH.
- The server is actually powered on (check the panel).
On the server (via console), allow SSH through the firewall:
# firewalld (CentOS/Rocky/Alma)
firewall-cmd --permanent --add-service=ssh && firewall-cmd --reload
# ufw (Ubuntu/Debian)
ufw allow 22/tcp && ufw reloadLocked out completely?
If you can't SSH in at all, use your provider's VNC / serial console from the control panel — it bypasses SSH and the network entirely, so you can fix the firewall or restart the daemon from there.
Read the exact word: "refused" is a service problem on a reachable server; "timed out" is a network or firewall problem before you ever reach it.
Other causes of "Connection refused" on a specific port
Beyond sshd being stopped: fail2ban may have banned your IP after too many failed logins (from you or someone else who tried the same public IP before you), sshd may be bound only to a specific interface/IP via ListenAddress, or SELinux can block sshd from binding to a non-default port until the port is labelled correctly with semanage port.
Other causes of "Connection timed out"
If your local firewall and the server both look fine, check for CGNAT or VPN routing on your side masking your real IP, and check the VPS/cloud provider's own network-level firewall or security group panel — a rule blocking port 22 there overrides anything you set inside the OS.
How to prevent SSH lockouts and connection errors
- Keep a console/VNC session bookmarked in your host panel for when SSH itself is unreachable.
- Never restrict SSH access by IP without a second way in (console access) as a fallback.
- Use fail2ban with a sensible, non-permanent ban time so a mistyped password doesn't lock you out for good.
- Monitor sshd with a basic healthcheck so a crashed daemon is caught before you need to connect urgently.
- Keep your firewall rules in a small script you can re-apply from the console after a lockout.
Related SSH and access errors
If SSH accepts the connection but rejects your key, see "Permission denied (publickey)". If you're being blocked after repeated attempts, read "Too many authentication failures". To lock SSH down properly once it's working, see how to harden SSH and how to install and use fail2ban.