Encountering a “Connection Refused” error when trying to SSH into your server is one of the most common—and frustrating—issues for Linux administrators. If you’ve just deployed a new instance or recently rebooted, here is a step-by-step diagnostic process to regain access to your server.
1. Verify SSH Service Status via Console
If you cannot SSH into the server, you will need out-of-band access. Most hosting providers, including the KVM console provided with Nextgen’s Cloud VPS Servers, offer a VNC or Web Console right from the client area.
Once logged into the VNC console as root, check if the SSH daemon is actually running:
systemctl status sshdIf it shows inactive (dead) or failed, attempt to start it:
systemctl start sshd
systemctl enable sshd2. Check UFW (Uncomplicated Firewall) Rules
A very common mistake when configuring a new server is enabling UFW before allowing port 22. If UFW is active and Port 22 is blocked, your packets will be dropped.
Check the UFW status:
ufw statusIf you do not see 22/tcp ALLOW IN Anywhere, you need to add the rule immediately:
ufw allow 22/tcp
ufw reloadNote: If you are utilizing a custom port for SSH (which is highly recommended for security, as discussed in our Linux Server Hardening Guide), ensure you allow that specific port instead of 22.
3. Verify sshd_config Bind Address
Sometimes, the SSH daemon is running, but it’s not binding to the correct IP address (or it’s only listening on localhost).
Open the SSH configuration file:
nano /etc/ssh/sshd_configLook for the ListenAddress directive. It should ideally be commented out (defaulting to all interfaces 0.0.0.0) or explicitly set to your server’s public IP address.
#ListenAddress 0.0.0.0
#ListenAddress ::If you make any changes, always restart the service:
systemctl restart sshd4. IP Conflict or Blacklisting
If you are using a dynamic IP at home (or a heavily shared network), tools like Fail2Ban might have automatically banned your IP after several failed login attempts.
You can check if your IP is jailed by Fail2Ban:
fail2ban-client status sshdIf your IP is listed, unban it:
fail2ban-client set sshd unbanip YOUR_PUBLIC_IPTo prevent this from happening, consider using a dedicated static IP. Many remote workers bypass these dynamic IP lockouts by bouncing their connection through a Dedicated Windows RDP to ensure a pristine, static IP address is always presented to the server.
Conclusion
“Connection Refused” typically boils down to three things: the service is down, the firewall is blocking it, or the port/IP configuration is mismatched. By methodically checking via the VNC console, you can restore access in minutes.
Ensure continuous SSH console access and network reliability with Nextgen’s Islamabad cloud VPS.
Need Enterprise-Grade Performance?
If your workload demands maximum processing power and zero resource-sharing, explore our bare-metal Dedicated Servers and Dedicated Servers in Pakistan. We offer ultra-low latency, unmetered bandwidth, and enterprise-grade hardware to scale your operations seamlessly.
