|
| 1 | +--- |
| 2 | +title: Troubleshoot OpenSSH Communication Through Windows Firewall |
| 3 | +description: Discusses how to troubleshoot issues that affect OpenSSH commands that pass through Windows Firewall. |
| 4 | +ms.date: 12/17/2025 |
| 5 | +manager: dcscontentpm |
| 6 | +audience: itpro |
| 7 | +ms.topic: troubleshooting |
| 8 | +ms.reviewer: kaushika, warrenw, v-appelgatet |
| 9 | +ai.usage: ai-assisted |
| 10 | +ms.custom: |
| 11 | +- sap:system management components\openssh (including sftp) |
| 12 | +- pcy:WinComm User Experience |
| 13 | +--- |
| 14 | +# Troubleshoot OpenSSH communication through Windows Firewall |
| 15 | + |
| 16 | +## Summary |
| 17 | + |
| 18 | +This article discusses how to troubleshoot issues that affect OpenSSH commands that pass through Windows Firewall. |
| 19 | + |
| 20 | +By default, OpenSSH uses TCP port 22. If this port is blocked or not listening, SSH commands fail. By default, OpenSSH listens on both IPv4 (0.0.0.0:22) and IPv6 ([::]:22). Windows Firewall settings, service status, and network permissions all play a crucial role in making sure that port 22 is both listening and accessible. Many factors can block OpenSSH communication, such as the following issues: |
| 21 | + |
| 22 | +- The OpenSSH service isn't running or is misconfigured. |
| 23 | +- Port 22 isn't listening because of service or firewall problems. |
| 24 | +- Windows Firewall blocks inbound SSH traffic. |
| 25 | +- Conflicting applications or policies use port 22. |
| 26 | +- Network connectivity problems, NAT appliances, or other firewall appliances block access to port 22. |
| 27 | + |
| 28 | +## How to troubleshoot OpenSSH communication through Windows Firewall |
| 29 | + |
| 30 | +### Step 1: Verify the basic functionality |
| 31 | + |
| 32 | +1. To verify that OpenSSH installed correctly, open a Windows PowerShell Command Prompt window, and then run the following command: |
| 33 | + |
| 34 | + ```powershell |
| 35 | + Get-Service -Name sshd |
| 36 | + ``` |
| 37 | + |
| 38 | + > [!IMPORTANT] |
| 39 | + > Make sure that you install the latest OpenSSH version, and keep it updated. |
| 40 | +
|
| 41 | +1. To verify that OpenSSH is listening on port 22, run the following command at either a PowerShell command prompt or a Windows command prompt: |
| 42 | + |
| 43 | + ```powershell |
| 44 | + netstat -an | findstr :22 |
| 45 | + ``` |
| 46 | + |
| 47 | + The following example shows the response to this command when port 22 is listening for traffic: |
| 48 | + |
| 49 | + ```output |
| 50 | + TCP 0.0.0.0:22 0.0.0.0:0 LISTENING |
| 51 | + TCP [::]:22 [::]:0 LISTENING |
| 52 | + ``` |
| 53 | + |
| 54 | +### Step 2: Make sure that Windows Firewall allows OpenSSH to use port 22 |
| 55 | + |
| 56 | +> [!IMPORTANT] |
| 57 | +> |
| 58 | +> - If possible, limit access to trusted IP addresses. |
| 59 | +> - Avoid using port 22 for non-OpenSSH traffic. |
| 60 | +> - Audit your firewall rules regularly. |
| 61 | +
|
| 62 | +1. To check for existing firewall rules, go to your OpenSSH client computer, and run the following cmdlet at a PowerShell command prompt: |
| 63 | + |
| 64 | + ```powershell |
| 65 | + Get-NetFirewallRule -DisplayName "*SSH*" | Get-NetFirewallPortFilter | Where-Object {$_.LocalPort -eq 22} |
| 66 | + ``` |
| 67 | + |
| 68 | +1. If you can't find an existing SSH rule, open an administrative PowerShell command prompt window. Then, run the following cmdlet: |
| 69 | + |
| 70 | + ```powershell |
| 71 | + New-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -DisplayName "OpenSSH Server (SSH)" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow |
| 72 | + ``` |
| 73 | + |
| 74 | +1. To verify that the rule is correctly configured, run `Get-NetFirewallRule` again. |
| 75 | + |
| 76 | +### Step 3: Review the event logs for errors |
| 77 | + |
| 78 | +In Event Viewer, review the entries in **Application and Services Logs** > **OpenSSH**. |
| 79 | + |
| 80 | +### Step 4: If the port isn't listening, configure it |
| 81 | + |
| 82 | +In the previous steps, if `netstat` didn't report port 22 as "Listening," and the firewall rule is correctly configured, follow these steps: |
| 83 | + |
| 84 | +1. To check the service status, run the following command at a PowerShell command prompt: |
| 85 | + |
| 86 | + ```powershell |
| 87 | + Get-Service -Name sshd |
| 88 | + ``` |
| 89 | + |
| 90 | +1. To check the OpenSSH configuration, open the C:\ProgramData\ssh\ folder, and then use a text editor to open the sshd_config file. |
| 91 | +1. Go to the `Port` section of the file. If the port information is commented out, uncomment it, and then make sure that the value is `22`. |
| 92 | + |
| 93 | + > [!IMPORTANT] |
| 94 | + > If you use port forwarding, see the [sshd_config](https://man.openbsd.org/sshd_config) manual page for configuration information. |
| 95 | +
|
| 96 | +1. To test the settings, run the following cmdlet at a PowerShell command prompt: |
| 97 | + |
| 98 | + ```powershell |
| 99 | + sshd -t |
| 100 | + ``` |
| 101 | + |
| 102 | +1. To restart the OpenSSH server service, run the following cmdlet at a PowerShell command prompt: |
| 103 | + |
| 104 | + ```powershell |
| 105 | + Restart-Service sshd |
| 106 | + ``` |
| 107 | + |
| 108 | +### Step 5: Test for firewall issues |
| 109 | + |
| 110 | +1. To create a temporary test rule, run the following cmdlet at a PowerShell command prompt: |
| 111 | + |
| 112 | + ```powershell |
| 113 | + New-NetFirewallRule -Name "SSH-Test" -DisplayName "SSH Test Rule" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow -Profile Any |
| 114 | + ``` |
| 115 | + |
| 116 | + > [!NOTE] |
| 117 | + > This cmdlet creates a temporary rule that's named "SSH Test Rule" to open port 22. By using this approach, you avoid having to disable the entire firewall. |
| 118 | +
|
| 119 | +1. Test some OpenSSH commands. If they work correctly, review and adjust your permanent firewall rules. |
| 120 | + |
| 121 | +1. When you're finished, remove the test rule by running the following cmdlet at a PowerShell command prompt: |
| 122 | + |
| 123 | + ```powershell |
| 124 | + Remove-NetFirewallRule -Name "SSH-Test" |
| 125 | + ``` |
| 126 | + |
| 127 | +### Step 6: Test for other network and network address translation (NAT) issues |
| 128 | + |
| 129 | +1. Make sure that external firewalls, routers, or NAT devices forward port 22 to your Windows host. |
| 130 | + |
| 131 | +1. Use the actual host name or IP address to test-run OpenSSH commands from another client computer. Run commands that resemble the following example: |
| 132 | + |
| 133 | + ```bash |
| 134 | + |
| 135 | + # or |
| 136 | + |
| 137 | + ``` |
| 138 | + |
| 139 | +1. To further test port connectivity, run the following cmdlet at the PowerShell command prompt: |
| 140 | + |
| 141 | + ```powershell |
| 142 | + Test-NetConnection -ComputerName <hostname_or_IP> -Port 22 |
| 143 | + ``` |
| 144 | + |
| 145 | +## Logging and diagnostics |
| 146 | + |
| 147 | +For information about verbose logging for OpenSSH, see [How to enable OpenSSH verbose logging](enable-openssh-verbose-logging.md). |
| 148 | + |
| 149 | +For information about connection attempts and errors, review the logs in %ProgramData%\ssh\logs. |
| 150 | + |
| 151 | +## Example scenarios |
| 152 | + |
| 153 | +**Scenario 1: SSH connection is refused** |
| 154 | +Cause: Firewall blocks port 22. |
| 155 | +Solution: Turn on or create an inbound rule for TCP port 22. |
| 156 | + |
| 157 | +**Scenario 2: Port 22 isn't listening** |
| 158 | +Cause: OpenSSH service isn't running or is misconfigured. |
| 159 | +Solution: Start the service, fix the configuration, and then run `sshd -t` to verify the result. If you changed the configuration, restart the service. |
| 160 | + |
| 161 | +**Scenario 3: Intermittent connectivity** |
| 162 | +Cause: Network device or NAT doesn't forward port 22. |
| 163 | +Solution: Check the router or firewall settings, and then test by using `Test-NetConnection`. For configuration information, see [sshd_config](https://man.openbsd.org/sshd_config). |
| 164 | + |
| 165 | +## Related articles |
| 166 | + |
| 167 | +- [OpenSSH Server configuration for Windows](/windows-server/administration/openssh/openssh_install_firstuse) |
| 168 | +- [How to enable OpenSSH verbose logging](enable-openssh-verbose-logging.md) |
| 169 | +- [OpenSSH Manual Pages](https://www.openssh.com/manual.html) |
| 170 | +- [Windows Firewall with Advanced Security](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) |
| 171 | +- [Troubleshooting OpenSSH in Windows](/windows-server/administration/openssh/openssh_server_configuration) |
0 commit comments