Cannot connect via SSH

Quick answer: Read the exact error first: a timeout points to network or firewall, connection refused means nothing is listening on the port, and permission denied means SSH works but authentication fails. Each has a different fix, and the KVM Console in the Client Area gets you in even when SSH cannot.

Overview

SSH failures look identical ("I can't get in") but split cleanly by error message. Identifying which of the three families you are in is 80% of the diagnosis.

Before you start

• The server IP, SSH port (22 unless you changed it) and username from the service page.
• Client Area access for the KVM Console fallback.

Step-by-step guide

1. Run SSH with verbose output and note the error family:

   ssh -v -p 22 root@YOUR_SERVER_IP

2. Timeout? Check the server is up (not responding guide) and that your IP is not blocked — log in via the KVM Console and inspect the firewall:

   sudo ufw status numbered
   sudo fail2ban-client status sshd

   An entry with your IP means you were auto-banned — unban it there.
3. Connection refused? The SSH service is down or listening elsewhere — see Connection refused error.
4. Permission denied? Wrong user, password or key — see Permission denied (publickey).
5. If you changed the SSH port and forgot it, check from the console:

   sudo grep -i '^port' /etc/ssh/sshd_config

Common issues

• Fail2ban banned your own IP after repeated wrong passwords — the most common lockout.
• Firewall rule added without allowing SSH — always allow the SSH port before enabling ufw.
• Using the Client Area password: the server has its own root/Administrator password shown on the service page.

When to contact support

If the KVM Console does not open, or the server refuses connections on every port while the console shows it healthy and online, open a ticket with the exact SSH error output and the time you first saw it.

Frequently asked questions

What is the difference between a timeout and connection refused?

A timeout means packets vanish — network problem or a DROP firewall rule. Connection refused is an active answer meaning nothing listens on the port: the server is reachable, the service is down.

How do I get in if I blocked myself with the firewall?

Use the KVM Console in the Client Area — it does not depend on the network. Log in there, remove or correct the firewall rule and unban your IP in Fail2ban if needed.

Why does my password work in the Client Area but not over SSH?

They are different credentials. The Client Area password manages billing and services on cloud2y.com, while SSH uses the operating-system login shown on the service page after deployment.

Related articles

• Connection refused error
• Permission denied (publickey) error
• How to connect to VPS via SSH
• My VPS is not responding

Need a hand? Contact Cloud2Y support →