Unable to SSH into EC2 instance – port 22 connection refused from local system

Since the error is “connection refused” (not timeout), the instance is reachable, but SSH is being rejected at the OS level.

Given that you’ve already run AWSSupport-TroubleshootSSH (with and without offline remediation), this is very likely due to something inside the instance, such as:

sshd service not running

ufw, iptables, or firewalld blocking port 22

SSH configuration getting modified during an update or upgrade

At this stage, the best approach is to access the instance without SSH first and check what’s blocking it.

Recommended approach: EC2 Instance Connect Endpoint (private access)

This lets you connect to the instance privately, without opening port 22 to the internet.

Step 1: Create an EC2 Instance Connect Endpoint

Go to EC2 → Instance Connect Endpoints

Click Create Instance Connect Endpoint

Select:

The VPC where your instance is running

A subnet in the same VPC (no internet gateway required)

Create the endpoint

Step 2: Ensure security group allows SSH from the endpoint

The instance security group must allow port 22

Source should be the endpoint security group (recommended) or the VPC CIDR

Step 3: Connect to the instance

Go to EC2 → Instances

Select the instance

Click Connect

Choose EC2 Instance Connect

Connect (this uses the endpoint, not public SSH)

Step 4: Check SSH and firewall inside the instance

Once connected, verify:

sudo systemctl status sshd sudo ss -tulpn | grep :22 sudo ufw status sudo iptables -L -n

If SSH is blocked:

sudo ufw allow 22 sudo systemctl restart sshd

Important notes

Timeout → usually network issue (SG, NACL, routing)

Connection refused → OS is reachable but rejecting SSH

Key or key permission issues usually cause authentication errors, not refusal

If you’re still unable to access the instance:

Detach the root volume

Attach it to a recovery instance

Fix SSH/firewall configs manually

This should help you pinpoint exactly what’s blocking SSH and fix it safely.

Try moving your local SSH known_hosts file to a different folder and then retry the SSH connection.

If the EC2 instance was rebuilt, restored, or had its host key changed, your local system may still be using an old host key and refusing the connection.

On your local machine:

mkdir -p ~/ssh-backup
mv ~/.ssh/known_hosts ~/ssh-backup/known_hosts

Also make sure:

There is no lock file such as known_hosts.lock or known_hosts_* under ~/.ssh/

There are no additional known_hosts files (for example known_hosts2 or known_hosts_old) that SSH might still be reading

You can confirm with:

ls -la ~/.ssh/

Then try connecting again:

ssh -vvv ec2-user@<EC2_PUBLIC_IP>

If SSH works after this, the issue was caused by a stale or mismatched host key in known_hosts.

This client-side issue is not detected by the AWSSupport-TroubleshootSSH automation, which only checks server-side configuration (security groups, NACLs, SSH service, permissions, etc.).

If the issue still persists, check for TCP Wrappers on the instance. Even though they are considered legacy, sshd can still honor them and immediately refuse incoming connections.

From an SSM session on the instance, check:

sudo cat /etc/hosts.deny sudo cat /etc/hosts.allow

If you see something like:

sshd: ALL

SSH connections will be refused instantly.

To test, temporarily move these files out of the way:

sudo mv /etc/hosts.deny /etc/hosts.deny.bak sudo mv /etc/hosts.allow /etc/hosts.allow.bak

Then try SSH again from your local machine. If SSH succeeds after this, the refusal was caused by TCP Wrapper rules rather than AWS networking, security groups, or the SSH service itself.

Also, don’t forget to check your local machine’s outbound firewall rules. In some environments, local iptables, ufw, or corporate endpoint security can block outbound SSH connections.

On your local system, verify:

sudo iptables -L -n sudo ufw status

Make sure there are no outbound DENY rules blocking TCP port 22. A local outbound block can also result in immediate SSH failures that look like server-side issues.

Based on your SSH connection being refused (rather than timing out), there are several potential causes and troubleshooting steps to consider:

1. Security Group Configuration: Verify that the security group associated with your instance allows inbound SSH traffic (port 22) from your IP address. The "connection refused" error suggests that packets are reaching the instance but being rejected, which could indicate a security group issue.

2. SSH Service Status: The SSH daemon (sshd) might not be running on your instance. This would cause connection attempts to be actively refused rather than timing out.

3. Network ACLs: Check that the Network ACL associated with your subnet allows both inbound and outbound traffic on port 22. Unlike security groups, Network ACLs are stateless and require rules for both directions.

4. OS-level Firewall: There might be an OS-level firewall (like iptables, firewalld, or ufw) on the instance that's blocking incoming SSH connections.

5. SSH Configuration: The SSH configuration file (/etc/ssh/sshd_config) might have settings that restrict connections from certain IP addresses or users.

Since you've already run the AWSSupport-TroubleshootSSH automation runbook without success, consider these additional steps:

1. Try connecting using EC2 Instance Connect through the AWS Management Console to bypass potential local network issues.

2. Use AWS Systems Manager Session Manager as an alternative way to access your instance if SSH continues to fail.

3. Check the instance's system logs in the EC2 console for any error messages related to SSH.

4. If possible, stop and start the instance (not just reboot) to see if that resolves the issue.

5. Enable VPC Flow Logs on the network interface of your EC2 instance to monitor traffic and diagnose potential security group or network configuration issues.

If none of these steps resolve the issue, you might need to consider launching a new instance with the same AMI and configuration in a different subnet or VPC to isolate whether the problem is specific to your current instance or network configuration.
Sources
Can not ssh to ec2 instance though no alarms and is running | AWS re:Post
Unable to SSH into AWS EC2 Instance – Connection Timed Out & Forgot Credentials | AWS re:Post
Unable to connect to EC2 instance. | AWS re:Post
Port 22: Connection Time Out Issue | AWS re:Post
Unable to ssh to an EC2 instance | AWS re:Post

Network problem - timeout disconnect. Connection refused - key, key permission issue

Thanks for the explanation.

I followed all the steps suggested so far, including accessing the instance using EC2 Instance Connect (private access) and checking things inside the instance.

What I have already verified:

• sshd service is running and listening on port 22
• ss -tulpn shows SSH listening on 0.0.0.0:22 and ::22
• iptables rules are empty / ACCEPT (no blocking)
• Security Group allows port 22
• NACL allows all inbound and outbound traffic
• Route table has a valid Internet Gateway route I can successfully connect using EC2 Instance Connect, but SSH using public IP still returns “Connection refused”.

I have attached screenshots for:

1. sshd status
2. port 22 listening
3. iptables rules
4. Security Group
5. NACL

At this point, I’m unable to identify what is rejecting SSH on port 22 for public access. Any expert plz help!!

Any guidance on what else could cause this would be really helpful.