How to fix refused connect from hostname in SSH

SSHINTERMEDIATEHIGHUpdated Oct 14, 2026· 255 views

The SSH daemon (sshd) is rejecting incoming connections from a specific hostname or IP address. This typically indicates TCP wrapper restrictions, firewall rules, or service misconfiguration preventing client access.

Quick fix

Fixes refused connect from hostname

sudo systemctl status sshd
  1. Check if SSH daemon is actually running
  2. Check TCP Wrappers configuration (hosts.allow/hosts.deny)
  3. Verify the connecting IP or hostname
  4. Check firewall rules (iptables or firewalld)
ssh — error
sudo systemctl status sshd
refused connect from hostname

What this error means

When sshd logs 'refused connect from hostname', it means the SSH server is actively rejecting the connection attempt before authentication occurs. This is different from a timeout or port closure. The refusal usually originates from TCP Wrappers (hosts.allow/hosts.deny files), which act as an additional access control layer on Linux systems. The SSH daemon checks these rules first, and if the connecting IP is explicitly denied or not explicitly allowed, the connection is refused. This message can also indicate that sshd itself encountered an error or is misconfigured.

Typical symptoms

  • SSH connection attempts immediately fail with 'Connection refused'
  • Client sees 'refused' message in debug output (ssh -vvv)
  • Server logs show 'sshd[PID]: refused connect from X.X.X.X' messages
  • Issue affects specific clients or subnets, while others can connect
  • Connections fail even though port 22 is open and sshd appears to be running
  • Problem persists after SSH authentication would have normally occurred

Common causes

  1. TCP Wrappers (hosts.deny) blocking the connecting IP address or hostname
  2. TCP Wrappers (hosts.allow) does not explicitly permit the connecting client
  3. SSH daemon was stopped or not properly started (appears running but rejects all connections)
  4. Firewall iptables rules or other kernel-level access controls rejecting connections
  5. SELinux or AppArmor policies preventing sshd from accepting connections
  6. Invalid or corrupted sshd configuration file preventing proper service initialization
  7. Fail2Ban or similar intrusion detection system blocking the IP address

How to fix "refused connect from hostname"

1Check if SSH daemon is actually running

First, verify that sshd is properly running and listening:

bash
sudo systemctl status sshd

If the status shows 'active (running)', restart it:

bash
sudo systemctl restart sshd

Then immediately test your connection again. Sometimes sshd can appear to be running but has a stale state.

2Check TCP Wrappers configuration (hosts.allow/hosts.deny)

TCP Wrappers is a common cause of 'refused connect' messages. Check both configuration files:

bash
sudo cat /etc/hosts.deny
sudo cat /etc/hosts.allow

Look for any lines containing 'sshd' or 'ALL'. If you see sshd: ALL in hosts.deny, that's blocking all SSH connections. Remove or comment out such lines.

To explicitly allow SSH from your client IP, add to /etc/hosts.allow:

bash
sudo echo 'sshd: 192.168.1.100' >> /etc/hosts.allow

Replace 192.168.1.100 with your actual client IP address.

3Verify the connecting IP or hostname

Identify what IP address or hostname the client is connecting from. Check the server logs:

bash
sudo tail -f /var/log/auth.log

Or on some systems:

bash
sudo tail -f /var/log/secure

Look for the 'refused connect from' line. Note the IP address shown. This is the address you need to allow in TCP Wrappers or firewall rules.

4Check firewall rules (iptables or firewalld)

Verify that your firewall isn't blocking port 22:

bash
sudo iptables -L -n | grep 22

Or for firewalld:

bash
sudo firewall-cmd --list-all | grep ssh

If port 22 is blocked, allow it:

With iptables:

bash
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

With firewalld:

bash
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload
5Review sshd_config for access restrictions

Check your SSH daemon configuration for any explicit restrictions:

bash
sudo cat /etc/ssh/sshd_config | grep -i 'allow\|deny'

Look for directives like AllowUsers, DenyUsers, AllowGroups, or DenyGroups. If your user or IP is in a deny list, remove it or add yourself to the allow list.

Also check for Protocol, ListenAddress, or Port misconfigurations. If sshd is not listening on the correct interface or port, connections will be refused.

6Check if Fail2Ban or similar tools are blocking the IP

If you have Fail2Ban installed, it might be blocking your IP:

bash
sudo fail2ban-client status sshd

If your IP is in the banned list, unban it:

bash
sudo fail2ban-client set sshd unbanip 192.168.1.100

Replace 192.168.1.100 with your actual IP address.

7Test the connection with verbose output

Once changes are made, test with verbose SSH output to confirm the connection:

bash
ssh -vvv user@hostname

This will show detailed logs of where the connection is failing. Look for 'refused' messages and use them to identify which component (TCP Wrappers, firewall, sshd config) is causing the rejection.

Advanced notes

TCP Wrappers (libwrap) is a legacy access control mechanism that some systems still use. To check if sshd was compiled with TCP wrapper support, run: ldd /usr/sbin/sshd | grep libwrap. If libwrap is listed, TCP Wrappers rules are active. On modern systems using systemd and SELinux, ensure SELinux booleans like ssh_sysadm_login are set correctly. Some container environments (Docker, Kubernetes) may have network policies that appear as 'refused connect' errors at the sshd level. Additionally, some systems use tcpd directly as a wrapper around sshd in inetd.conf or systemd socket activation, which can also trigger this message. Always check system logs (journalctl, /var/log/auth.log) for the exact sshd error codes for more precise troubleshooting.

Frequently asked questions

What does "refused connect from hostname" mean?
When sshd logs 'refused connect from hostname', it means the SSH server is actively rejecting the connection attempt before authentication occurs. This is different from a timeout or port closure. deny files), which act as an additional access control layer on Linux systems.
How do I fix "refused connect from hostname"?
The SSH daemon (sshd) is rejecting incoming connections from a specific hostname or IP address. This typically indicates TCP wrapper restrictions, firewall rules, or service misconfiguration preventing client access.
What causes "refused connect from hostname"?
TCP Wrappers (hosts.deny) blocking the connecting IP address or hostname TCP Wrappers (hosts.allow) does not explicitly permit the connecting client SSH daemon was stopped or not properly started (appears running but rejects all connections)
Is the "refused connect from hostname" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading