Test the port itself
A reply to ping or a working website says nothing about SSH, because each uses a different protocol or port. Test the TCP port directly from the client. Connection refused means that something answered and no service accepted the connection. A timeout means that nothing answered, which usually points to a firewall, routing or a machine that is overloaded.
nc -vz -w 5 server.example 22
ssh -v -o ConnectTimeout=5 user@server.exampleConnection refused: check sshd on the console
Use the provider or hypervisor console, not SSH. Check that the service runs, which address and port it listens on, and whether the configuration is valid. On recent Ubuntu releases SSH starts through ssh.socket, so inspect the socket unit as well. Other distributions may name the service sshd.
sudo systemctl status ssh.service ssh.socket
sudo ss -lntp | grep -E ':22\b|sshd'
sudo sshd -t
sudo journalctl -u ssh -n 50 --no-pagerTimeout: check the firewalls
Look at the firewall on the server and also at any filter outside it, such as a cloud security group, the router or the provider panel. To see whether packets arrive at all, run tcpdump on the server during a connection attempt. If nothing appears, the block is before the server. If packets arrive and no reply leaves, look on the server.
sudo ufw status verbose
sudo nft list ruleset | less
sudo tcpdump -ni any tcp port 22Blocked by fail2ban or by a changed port
After failed logins, fail2ban may have blocked your address, which looks like a timeout or a refused connection from your address only. Testing from another network shows this quickly. Also check whether the port was moved with Port or limited to one address with ListenAddress in sshd_config or in a file under /etc/ssh/sshd_config.d.
sudo fail2ban-client status sshd
sudo sshd -T | grep -E '^(port|listenaddress) 'The port connects but login hangs
If the TCP connection succeeds but the SSH banner never arrives, sshd is alive only partly or the system is overloaded. Look at memory, disk space and load on the console. A full disk or exhausted memory can stop new sessions while existing services still answer.
uptime
free -h
df -hChecking it with CH-J Server Manager
Server Diagnostics can test ping, a TCP connection and the SSH identification string without logging in, for IPv4 and IPv6, so you can see which stage fails. It works from your computer only. It cannot see inside the server or tell which firewall dropped a packet, so you still need the console for the checks above.