How to Fix 'Connection Refused' and Timeout SSH Errors on a VPS

Secure Shell (SSH) is the primary protocol used by systems administrators to securely connect and manage Linux servers remotely. When an SSH connection fails, returning a "Connection Refused" or "Connection Timed Out" error, you are locked out of your server. When this occurs, resolving the lockout requires identifying whether the issue is due to sshd service crashes, firewall blocks, custom port changes, or configuration errors.

Being locked out of your VPS can be stressful, especially during service outages. However, most SSH connection errors are due to simple configuration issues that can be diagnosed systematically. In this guide, we will analyze common SSH failure causes, discuss troubleshooting steps, and walk through the recovery options to restore access to your VPS.

1. Diagnosing SSH Errors: Connection Refused vs. Timeout

The error message returned by your SSH client helps narrow down the cause of the connection failure:

Connection Refused: Indicates that the request reached your server IP address, but the server actively rejected the connection on the requested port. This can occur if the SSH daemon (sshd) is offline, or if the service is configured to listen on a different port than the one requested.
Connection Timed Out: Indicates that the request did not receive a response from the server. This is typically caused by network firewall blocks (at your host or local network level) or if the server itself is offline or experiencing network routing issues.

2. Step-by-Step Troubleshooting and Recovery

Because you are locked out of SSH, you cannot run commands on the server directly. You will need to use your hosting provider's web-based console (VNC or serial console) or management portal to troubleshoot and apply fixes.

Step 2.1: Verify Server Power and Network Status

First, log into your hosting provider's billing or VPS management portal. Verify that your virtual machine's status is "Running". If the server is offline or frozen, restart the VM through the portal. You can also run a ping test to check network connectivity:

ping server_ip_address

If ping requests time out, the server is offline or experiencing network issues, requiring assistance from your hosting provider's support team.

Step 2.2: Access the Server via Web Console (VNC)

If the server is running but SSH connections fail, open your host's web console (VNC console) to access the command line interface. Log in as the root user. This bypasses network SSH connections, allowing you to troubleshoot the configuration locally.

Step 2.3: Verify the SSH Daemon Status

Check if the SSH service is active and running on your server. Run the appropriate command based on your Linux distribution:

systemctl status sshd        # For RHEL/AlmaLinux/CentOS
systemctl status ssh         # For Debian/Ubuntu

If the service is stopped or failing, check the service log files to identify the cause of the failure before restarting it:

systemctl restart sshd       # Restart SSH service daemon

Step 2.4: Verify the SSH Port Configuration

If the service is running but connections are refused, check your SSH configuration file to verify the active listening port:

grep -i "port" /etc/ssh/sshd_config

By default, SSH uses port 22. If the configuration shows a custom port (e.g., Port 2222), update your SSH client connection settings to use the custom port number. Ensure that the custom port is whitelisted in your server's firewall rules.

Step 2.5: Check Firewall Rules and Blocks

If you see connection timeouts, the issue is likely due to a firewall blocking traffic on the SSH port. Check if your server firewall (such as IPTables, UFW, or CSF) has blocked your local IP address due to multiple failed login attempts.

Temporary disable the firewall via the local VNC console to test the connection:

ufw disable                  # Disable Ubuntu firewall
systemctl stop firewalld     # Disable RHEL firewall
csf -x                       # Disable CSF firewall

If SSH connects successfully while the firewall is disabled, whitelist your local IP address in your firewall configuration before re-enabling it.

3. SSH Troubleshooting Checklist

Error Message	Possible Cause	Recommended Action via Console
ssh: connect to host IP port 22: Connection refused	SSH daemon is offline or listening on a custom port	Start sshd service; verify port settings in `/etc/ssh/sshd_config`
ssh: connect to host IP port 22: Connection timed out	Firewall block (IP blocked or port closed)	Disable firewall; whitelist local IP; verify server network routing
Permission denied (publickey,password)	Incorrect login credentials or SSH key mismatch	Verify SSH key installation; check password authentication settings

Frequently Asked Questions (FAQ)

What is VNC or Serial Console and how does it help?

VNC and Serial Consoles are management tools provided by hosting hosts that establish a direct connection to your server's physical display interface. This allows you to log in and manage the server locally through a web browser, bypassing network and SSH connection issues.

Should I change the default SSH port 22?

Yes. Changing the default SSH port to a custom high port (e.g., 2244) is a security best practice. It helps protect your server from automated bots that scan the internet scanning for active SSH portals on port 22, reducing the volume of brute-force login attempts in your system logs.

Why does my SSH connection drop with "broken pipe"?

A "broken pipe" error occurs when the connection between your client and the server is interrupted due to network timeouts, router timeouts, or server-side inactivity settings. To keep connections active, configure SSH keep-alive packets in your client configuration file.