ssh: 'connect to host <host> port 22: Connection refused' vs 'Connection timed out' vs 'Operation timed out'. What does each mean and how do I fix SSH connections?

Cause: the two errors point to different layers. - Connection refused: the host was reached, but nothing accepted connections on that port (sshd not installed or not running, listening on a different port or address, or the host actively rejecting). Often a container or VM without an SSH server, or sshd configured with a non-default Port. - Connection timed out: no answer at all. A firewall (cloud security group, host firewall, corporate network) drops the packets, the IP/hostname is wrong or not routable (private IP from outside the network), or the machine is down. Fix: 1. Check the target and port: ssh -v user@host shows which address and port it tries. Confirm DNS resolves to the right IP, and use -p <port> if sshd listens on another port. 2. For 'refused', on the server (console access): check sshd is running (systemctl status ssh or sshd), and what it listens on (ss -ltnp | grep ssh). The Port and ListenAddress settings in /etc/ssh/sshd_config control this; after edits, test the config with sshd -t before restarting so you don't lock yourself out. 3. For 'timed out', check the path: cloud security groups/firewall rules must allow your source IP on that port; host firewalls (ufw, firewalld) must allow it; and you may need a VPN or bastion host for private addresses (ssh -J bastion user@private-host). 4. Test reachability without SSH: nc -vz host 22 (or Test-NetConnection host -Port 22 on Windows). 5. Prefer key-based auth and restrict who can reach port 22 rather than opening it to the whole internet. Verify: ssh -v connects and reaches the authentication step; then fix any authentication errors separately. Sources: https://man.openbsd.org/ssh https://man.openbsd.org/sshd_config