Encountering a “Connection Refused” error when trying to SSH into your server is one of the most common—and frustrating—issues for Linux administrators. If you’ve just deployed a new instance or recently rebooted, here is a step-by-step diagnostic process to regain access to your server.
1. Verify SSH Service Status via Console
If you cannot SSH into the server, you will need out-of-band access. Most hosting providers, including the KVM console provided with Nextgen’s Cloud VPS Servers, offer a VNC or Web Console right from the client area.
Once logged into the VNC console as root, check if the SSH daemon is actually running:
systemctl status sshdIf it shows inactive (dead) or failed, attempt to start it:
systemctl start sshd
systemctl enable sshd2. Check UFW (Uncomplicated Firewall) Rules
A very common mistake when configuring a new server is enabling UFW before allowing port 22. If UFW is active and Port 22 is blocked, your packets will be dropped.
Check the UFW status:
ufw statusIf you do not see 22/tcp ALLOW IN Anywhere, you need to add the rule immediately:
ufw allow 22/tcp
ufw reloadNote: If you are utilizing a custom port for SSH (which is highly recommended for security, as discussed in our Linux Server Hardening Guide), ensure you allow that specific port instead of 22.
3. Verify sshd_config Bind Address
Sometimes, the SSH daemon is running, but it’s not binding to the correct IP address (or it’s only listening on localhost).
Open the SSH configuration file:
nano /etc/ssh/sshd_configLook for the ListenAddress directive. It should ideally be commented out (defaulting to all interfaces 0.0.0.0) or explicitly set to your server’s public IP address.
#ListenAddress 0.0.0.0
#ListenAddress ::If you make any changes, always restart the service:
systemctl restart sshd4. IP Conflict or Blacklisting
If you are using a dynamic IP at home (or a heavily shared network), tools like Fail2Ban might have automatically banned your IP after several failed login attempts.
You can check if your IP is jailed by Fail2Ban:
fail2ban-client status sshdIf your IP is listed, unban it:
fail2ban-client set sshd unbanip YOUR_PUBLIC_IPTo prevent this from happening, consider using a dedicated static IP. Many remote workers bypass these dynamic IP lockouts by bouncing their connection through a Dedicated Windows RDP to ensure a pristine, static IP address is always presented to the server.
Conclusion
“Connection Refused” typically boils down to three things: the service is down, the firewall is blocking it, or the port/IP configuration is mismatched. By methodically checking via the VNC console, you can restore access in minutes.
Ensure continuous SSH console access and network reliability with Nextgen’s Islamabad cloud VPS.
