Connection Refused PuTTY to VMWare Workstation Guest Rocky Linux

The "Connection Refused" error in PuTTY when targeting a VMware Workstation guest running Rocky Linux typically indicates that the SSH daemon is not listening on the expected network interface or port. This is most commonly caused by the virtual machine's network adapter being set to NAT mode with an isolated subnet, while the host machine attempts to connect via localhost without proper port forwarding configured.

Verifying Network Adapter Configuration

The first step in troubleshooting this connectivity issue is to examine how the virtual machine is connected to the physical network. In VMware Workstation, the default configuration for new virtual machines is often "NAT" mode. While NAT allows the guest OS to access the internet through the host, it does not automatically expose the guest's services to the host unless specific rules are applied. If your VM is set to NAT, you cannot simply connect to the host's IP address (127.0.0.1) and expect traffic to route directly into the guest's SSH service on port 22 without additional configuration. To check your current setting, open VMware Workstation and navigate to the virtual machine settings. Select the Network Adapter option. You will see three choices: Bridged, NAT, and Custom. If you wish to avoid complex port forwarding rules, switching this to Bridged mode is the most straightforward solution. Bridged mode makes the VM appear as a distinct device on your local LAN, assigning it its own IP address from your router's DHCP pool. Once switched to Bridged, ensure that the "Connect at power on" box is checked. After applying these changes, restart the virtual machine. The guest Rocky Linux instance should now acquire a unique IP address visible from the host machine, which can be found using the ip addr show command within the terminal.

Configuring Port Forwarding in NAT Mode

If you must keep the network adapter in NAT mode, perhaps due to corporate firewall restrictions or specific lab requirements, you need to manually configure port forwarding. This process tells VMware Workstation to listen on a specific port on the host and redirect incoming traffic to the guest's internal IP. Access the Edit menu in VMware Workstation and select Virtual Network Editor. You may need administrative privileges to modify these settings. Locate the VMnet8 entry, which corresponds to the NAT network, and click on NAT Settings. In the Port Forwarding section, click Add. You will need to define a Host Port and a Guest Port. Typically, you map Host Port 2222 to Guest Port 22. This means you will connect to PuTTY using the host's IP address on port 2222 instead of the standard SSH port. Ensure that the IP address listed for the guest matches the one assigned by VMware's internal DHCP server. Save the settings and restart the VMware services if necessary. This method isolates the SSH traffic but requires careful management of port numbers to avoid conflicts with other services running on the host. For users managing cloud instances rather than local VMs, similar connectivity issues arise when trying to reach EC2 instances. See our guide on Unable to Connect Linux EC2 Instance via Putty (OpenSSH) on Windows Machine for broader context on SSH connection refusals across different environments.

Checking the OpenSSH Service Status

Even with correct network configurations, the SSH server itself might not be running or might be bound to a different interface. Rocky Linux uses systemd to manage services. Open a terminal inside the Rocky Linux guest and run sudo systemctl status sshd. If the service is inactive or failed, start it using sudo systemctl enable --now sshd. This command ensures the service starts automatically upon boot and begins immediately. You should also verify that the service is listening on the correct interface. Use the command ss -tlnp | grep :22 to list active TCP listeners on port 22. Look for lines indicating :22 associated with either 0.0.0.0 or ::. If you see only 127.0.0.1:22, the SSH daemon is restricted to local connections only, rejecting external attempts from the host or network. To fix this, edit the /etc/ssh/sshd_config file. Find the line starting with #ListenAddress and uncomment it, ensuring it is set to 0.0.0.0 or removed entirely to allow all interfaces. Restart the SSH service after making any changes to the configuration file.

Inspecting Firewall Rules

Rocky Linux employs firewalld as its default dynamic firewall manager. Even if SSH is running and listening, the firewall may block incoming connections on port 22. Check the current status by running sudo firewall-cmd --list-all. Look for the ports or services sections in the output. If ssh is not listed under services, or if port 22 is not explicitly allowed, you must add it. Enable the SSH service permanently by executing sudo firewall-cmd --permanent --add-service=ssh. Follow this by reloading the firewall configuration with sudo firewall-cmd --reload. This ensures that the rule persists across reboots. If you are using a custom port due to port forwarding, you must add the specific port instead, such as sudo firewall-cmd --permanent --add-port=2222/tcp. Verify the change again with --list-all to confirm the port or service is now permitted. Another common pitfall involves SELinux contexts, though less likely to cause a hard refusal compared to firewalls. Ensure that SELinux is not enforcing strict policies that block SSH. You can check the status with getenforce. If it returns Enforcing, verify that the SSH ports are correctly labeled using semanage port -l | grep ssh. Usually, the default setup handles this correctly, but misconfigurations can occur. For those encountering gateway issues that complicate network routing in virtual environments, refer to Troubleshooting Weird Gateway Issue in VMware to ensure your virtual network infrastructure is stable.

Testing Connectivity and Final Verification

Once the network mode, SSH service, and firewall are aligned, test the connection from the host machine. Open PuTTY and enter the IP address of the host (for NAT with port forwarding) or the guest (for Bridged). Set the port number accordingly. If you changed the SSH port in sshd_config, update the PuTTY port field to match. Click Open. If the connection still fails, use the telnet command or nc -zv from the host command line to test raw TCP connectivity before invoking PuTTY. For example, nc -zv 192.168.x.x 22 will tell you if the port is reachable at the packet level. If tel succeeds but PuTTY fails, the issue lies within PuTTY's key exchange algorithms or encryption settings, requiring you to adjust the connection type to SSH-2 and potentially disable older cipher suites in the PuTTY configuration window.

Frequently Asked Questions

Why does my VM have no IP address in Bridged mode?

This usually happens because the physical network does not provide DHCP addresses, or the virtual switch is disconnected. Ensure your physical Ethernet or Wi-Fi adapter is active and that the VMware Virtual Network Editor has the correct bridged adapter selected. Restarting the network service inside the guest with sudo systemctl restart NetworkManager often resolves stale lease issues.

Can I use SSH keys instead of passwords for PuTTY?

Yes, generating an SSH key pair on your host and adding the public key to ~/.ssh/authorized_keys on the Rocky Linux guest is more secure than password authentication. You must ensure PubkeyAuthentication yes is set in /etc/ssh/sshd_config and restart the SSH service. PuTTY then uses Pageant or direct key loading to authenticate seamlessly.

What causes 'Host Key Verification Failed' after fixing Connection Refused?

This error occurs when the SSH host key changes, often because the VM was cloned or the disk image restored from a backup. Delete the old host key entries from your known_hosts file on the host machine, or accept the new key prompt in PuTTY. This confirms you are connecting to the updated virtual machine identity.

Is it safe to disable firewalld completely?

Disabling the firewall is generally unsafe as it exposes all services to potential attacks. Instead, selectively allow only the necessary ports like SSH (22) and any other required services. Using firewall-cmd --add-service=ssh maintains security while enabling the specific connectivity you need for remote administration.

How do I find the guest IP if I am unsure of the network setup?

Log into the VMware Workstation console directly and run hostname -I or ip addr show inside the Rocky Linux terminal. This displays all assigned IP addresses regardless of whether the network is NAT, Bridged, or Host-only. Use the IPv4 address corresponding to the active interface for your PuTTY connection.