Skip to content

Commit 790194d

Browse files
v-tappelgatev-tappelgate
committed
AB#7981:OpenSSH and Windows Firewall: Ensuring Port 22 is Listening and Accessible
New article for [CI 7981](https://dev.azure.com/KMOps/ContentExperience/_queries/edit/7981)
1 parent 62cc19b commit 790194d

1 file changed

Lines changed: 170 additions & 0 deletions

File tree

‎support/windows-server/system-management-components/troubleshoot-openssh-windows-firewall-port22.md‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
---
2+
title: Troubleshoot OpenSSH Communication through Windows Firewall
3+
description: Discusses how to troubleshoot issues that affect OpenSSH commands that pass through Windows Firewall.
4+
ms.date: 12/17/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika, warrenw, v-appelgatet
9+
ms.custom:
10+
- sap:system management components\openssh (including sftp)
11+
- pcy:WinComm User Experience
12+
---
13+
# Troubleshoot OpenSSH communication through Windows Firewall
14+
15+
## Summary
16+
17+
This article discusses how to troubleshoot issues that affect OpenSSH commands that pass through Windows Firewall.
18+
19+
By default, OpenSSH uses TCP port 22. If this port is blocked or not listening, SSH commands fail. By default, OpenSSH listens on both IPv4 (0.0.0.0:22) and IPv6 ([::]:22). Windows Firewall settings, service status, and network permissions all play a crucial role in ensuring that port 22 is both listening and accessible. A number of factors can block OpenSSH communication, such as the following issues:
20+
21+
- The OpenSSH service isn't running or is misconfigured.
22+
- Port 22 isn't listening because of service or firewall problems.
23+
- Windows Firewall blocks inbound SSH traffic.
24+
- Conflicting applications or policies use port 22.
25+
- Network connectivity problems, NAT appliances, or other firewall appliances block access to port 22.
26+
27+
## How to troubleshoot OpenSSH communication through Windows Firewall
28+
29+
### Step 1: Verify the basic functionality
30+
31+
1. To verify that OpenSSH installed correctly, open a Windows PowerShell Command Prompt window and then run the following command:
32+
33+
```powershell
34+
Get-Service -Name sshd
35+
```
36+
37+
> [!IMPORTANT]
38+
> Make sure that you install the latest OpenSSH version, and keep it updated.
39+
40+
1. To verify that OpenSSH is listening on port 22, run the following command at either a PowerShell command prompt or a Windows command prompt:
41+
42+
```powershell
43+
netstat -an | findstr :22
44+
```
45+
46+
The following example shows the response to this command when port 22 is listening for traffic.
47+
48+
```output
49+
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING
50+
TCP [::]:22 [::]:0 LISTENING
51+
```
52+
53+
### Step 2: Make sure that Windows Firewall allows OpenSSH to use port 22
54+
55+
> [!IMPORTANT]
56+
>
57+
> - If possible, limit access to trusted IP addresses.
58+
> - Avoid using port 22 for non-OpenSSH traffic.
59+
> - Audit your firewall rules regularly.
60+
61+
1. To check for existing firewall rules, on you OpenSSH client computer, run the following cmdlet at a PowerShell command prompt.
62+
63+
```powershell
64+
Get-NetFirewallRule -DisplayName "*SSH*" | Get-NetFirewallPortFilter | Where-Object {$_.LocalPort -eq 22}
65+
```
66+
67+
1. If you can't find an existing SSH rule, open and administrative PowerShell command prompt window. Then run the following cmdlet:
68+
69+
```powershell
70+
New-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -DisplayName "OpenSSH Server (SSH)" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow
71+
```
72+
73+
1. To check that the rule is correctly configured, run `Get-NetFirewallRule` again.
74+
75+
### Step 3: Review the event logs for errors
76+
77+
In Event Viewer, review the entries in **Application and Services Logs** > **OpenSSH**.
78+
79+
### Step 4: If the port isn't listening, configure it
80+
81+
If in the previous steps `netstat` didn't report port 22 as "Listening," and the firewall rule is correctly configured, follow these steps:
82+
83+
1. To check the service status, run the following command at a PowerShell command prompt:
84+
85+
```powershell
86+
Get-Service -Name sshd
87+
```
88+
89+
1. To check the OpenSSH configuration, in the C:\ProgramData\ssh\ folder, use a text editor to open the sshd_config file.
90+
1. Go to the `Port` section of the file. If the port information is commented out, uncomment it, and then make sure that the value is `22`.
91+
92+
> [!IMPORTANT]
93+
> If you use port forwarding, see the [sshd_config](https://man.openbsd.org/sshd_config) manual page for configuration information.
94+
95+
1. To test the settings, run the following cmdlet at a PowerShell command prompt:
96+
97+
```powershell
98+
sshd -t
99+
```
100+
101+
1. To restart the OpenSSH server service, run the following cmdlet at a PowerShell command prompt.
102+
103+
```powershell
104+
Restart-Service sshd
105+
```
106+
107+
### Step 5: Test for firewall issues
108+
109+
1. To create a temporary test rule, run the following cmdlet at a PowerShell command prompt
110+
111+
```powershell
112+
New-NetFirewallRule -Name "SSH-Test" -DisplayName "SSH Test Rule" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow -Profile Any
113+
```
114+
115+
> [!NOTE]
116+
> This cmdlet creates a temporary rule called "SSH Test Rule" that opens port 22. By using this approach, you avoid having to disable the entire firewall.
117+
118+
1. Test some OpenSSH commands. If they work correctly, review and adjust your permanent firewall rules.
119+
120+
1. When you're finished, remove the test rule by running the following cmdlet at a PowerShell command prompt.
121+
122+
```powershell
123+
Remove-NetFirewallRule -Name "SSH-Test"
124+
```
125+
126+
### Step 6: Test for other network and network address translation (NAT) issues
127+
128+
1. Make sure that external firewalls, routers, or NAT devices forward port 22 to your Windows host.
129+
130+
1. Use the actual host name or IP address to test-run OpenSSH commands from another client computer. Run commands that resemble the following example:
131+
132+
```bash
133+
ssh [email protected]
134+
# or
135+
ssh [email protected]
136+
```
137+
138+
1. To further test port connectivity, run the following cmdlet at the PowerShell command prompt:
139+
140+
```powershell
141+
Test-NetConnection -ComputerName <hostname_or_IP> -Port 22
142+
```
143+
144+
## Logging and diagnostics
145+
146+
For information about verbose logging for OpenSSH, see [How to enable OpenSSH verbose logging](enable-openssh-verbose-logging.md).
147+
148+
Review the logs in %ProgramData%\ssh\logs for information about connection attempts and errors.
149+
150+
## Example scenarios
151+
152+
**Scenario 1: SSH connection is refused**
153+
Cause: Firewall blocks port 22.
154+
Solution: Turn on or create an inbound rule for TCP port 22.
155+
156+
**Scenario 2: Port 22 isn't listening**
157+
Cause: OpenSSH service isn't running or is misconfigured.
158+
Solution: Start the service, fix the configuration, and then run `sshd -t` to verify the result. If you changed the configuration, restart the service.
159+
160+
**Scenario 3: Intermittent connectivity**
161+
Cause: Network device or NAT doesn't forward port 22.
162+
Solution: Check the router or firewall settings, and then test by using `Test-NetConnection`. For configuration information, see [sshd_config](https://man.openbsd.org/sshd_config).
163+
164+
## Related articles
165+
166+
- [OpenSSH Server configuration for Windows](https://learn.microsoft.com/windows-server/administration/openssh/openssh_install_firstuse)
167+
- [How to enable OpenSSH verbose logging](enable-openssh-verbose-logging.md)
168+
- [OpenSSH Manual Pages](https://www.openssh.com/manual.html)
169+
- [Windows Firewall with Advanced Security](https://learn.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)
170+
- [Troubleshooting OpenSSH in Windows](https://learn.microsoft.com/windows-server/administration/openssh/openssh_server_configuration)

0 commit comments

Comments
 (0)