SSH Connection Refused or Hangs, But the Server Is Definitely Up

The error: SSH connection attempts either get refused outright or hang indefinitely with no response, even though the server is confirmed running and reachable via ping.

Environment: Any Linux server running sshd.

Why this happens: "Connection refused" and "hangs with no response" point at genuinely different layers, which is the first thing worth separating before troubleshooting further. Refused means something actively rejected the connection (sshd not running, or a firewall sending an active reject). Hanging with no response usually means a firewall is silently dropping the packets rather than rejecting them — or, less commonly, that fail2ban or a similar tool has actively banned the connecting IP after prior failed attempts.

The fix:

1. Confirm sshd is actually running: systemctl status sshd.
2. Check local firewall rules: firewall-cmd --list-all or iptables -L -n, confirming port 22 (or whatever port SSH is configured on) is actually allowed.
3. If a specific IP is failing while others work, check fail2ban specifically: fail2ban-client status sshd will show currently banned addresses.
4. Check /etc/hosts.allow and /etc/hosts.deny if those are in use — an older but still-functional access control mechanism that's easy to forget exists.

One thing worth knowing: a fail2ban lockout after a bad password attempt (your own typo, testing a script, whatever) looks identical to a firewall problem from the outside — check fail2ban status early rather than assuming it's a config issue on the server side.