What port does SSH use? Port 22, and how to change it

Port 22 is the port registered for SSH, and an SSH server listens there unless someone changes it. SSH only uses TCP, so there's nothing to open for UDP. Everything that runs over SSH uses the same port:

So if you can SSH to a server, SFTP to it works on the same port with the same sign-in. The SFTP guide covers the commands.

Add the port to the command. Note the capital -P for scp and sftp:

ssh -p 2222 admin@server.example.com
ssh ssh://admin@server.example.com:2222
scp -P 2222 report.pdf admin@server.example.com:/tmp/
sftp -P 2222 admin@server.example.com
rsync -av -e "ssh -p 2222" photos/ admin@server.example.com:backup/photos/

ssh admin@server.example.com:2222 doesn't work: ssh reads the whole thing as a host name. These commands are the same in a Linux or Mac terminal and in PowerShell on Windows 10 and 11. To stop typing the port, save it once in a Host entry of your SSH config file; after that, plain ssh web uses the right port.

1. 1

   Step 1: Pick a free port

   Choose a number above 1024 that nothing else uses, such as 2222. sudo ss -tln lists the ports already taken.

2. 2

   Step 2: Open it in the firewall first

   With ufw (Ubuntu): sudo ufw allow 2222/tcp. With firewalld (Fedora, RHEL, Rocky Linux, AlmaLinux):

   sudo firewall-cmd --permanent --add-port=2222/tcp
   sudo firewall-cmd --reload

   On a cloud server, also allow the port in the provider's firewall or security group.

3. 3

   Step 3: Allow it in SELinux (Fedora and RHEL family only)

   SELinux only lets the SSH server use ports labeled for it. Add the label with sudo semanage port -a -t ssh_port_t -p tcp 2222 (semanage is in the policycoreutils-python-utils package). Ubuntu and Debian skip this step.

4. 4

   Step 4: Set the new port

   Open the settings with sudo nano /etc/ssh/sshd_config, find #Port 22 and change it to Port 2222. While you test, you can keep a second line, Port 22: the server then listens on both. Save, and check the file with sudo sshd -t (no output means it's fine).

5. 5

   Step 5: Restart SSH

   Which command depends on the system:

   # Ubuntu 22.10 and later, including 24.04 (SSH listens through ssh.socket)
   sudo systemctl daemon-reload
   sudo systemctl restart ssh.socket
   
   # Ubuntu 22.04 and Debian
   sudo systemctl restart ssh
   
   # Fedora, RHEL, Rocky Linux, AlmaLinux and Arch
   sudo systemctl restart sshd

   sudo ss -tln should now show the new port. If Ubuntu 24.04 still shows only 22, run the daemon-reload and the restart ssh.socket again.

6. 6

   Step 6: Test, then close the old port

   Keep your current session open and connect from a second terminal with ssh -p 2222 user@server. When that works, remove the Port 22 line if you kept it, restart again, and delete the old firewall rule (sudo ufw delete allow OpenSSH, or sudo ufw delete allow 22/tcp, whichever you added).

In PowerShell as administrator, open the server's settings, set the port, allow it in Windows Firewall and restart the service:

notepad C:\ProgramData\ssh\sshd_config      # change #Port 22 to Port 2222, then save
New-NetFirewallRule -Name sshd-2222 -DisplayName "OpenSSH Server (port 2222)" -Direction Inbound -Protocol TCP -LocalPort 2222 -Action Allow
Restart-Service sshd
Get-NetTCPConnection -LocalPort 2222 -State Listen

The last line shows the server listening on the new port. If OpenSSH Server isn't installed yet, see how to turn on OpenSSH Server in Windows 11.

• On the server: sudo ss -tln on Linux, or Get-NetTCPConnection -State Listen on Windows, lists the ports in use. Look for 22 or your own port.
• From a Linux or Mac computer: nc -zv server.example.com 22 says whether the port answers.
• From Windows: Test-NetConnection server.example.com -Port 22, then look for TcpTestSucceeded : True.
• From the internet, for a machine at home: after forwarding port 22 on your router, the open port checker tests whether port 22 is reachable on the connection you're browsing from.

If it fails, connection refused means nothing listens on that port (or a firewall rejects it), and connection timed out usually means a firewall drops it or the address is wrong. ssh -v shows where the connection stops. If the port answers but ssh gives up with Unable to negotiate, the port is fine: see how to fix no matching host key type found.

Moving SSH off port 22 cuts down the automated login attempts that fill a server's logs, because many scanners only try 22. It isn't protection on its own, though: anyone who scans all ports still finds it. What actually keeps a server safe:

• Key sign-in, with password sign-in turned off: see passwordless SSH with keys.
• No direct root sign-in, and only the accounts that need SSH.
• Updates, so the SSH server gets its security fixes.
• Not exposing SSH to the internet at all when you don't need to. RemoteAccessApp can reach an SSH server on your home or office network through one of your own PCs there, with no port forwarded on the router.

In the RemoteAccessApp SSH client, every saved host has its own Port box, filled with 22 for SSH and SFTP. Change it when you add or edit the host. Pasting admin@server.example.com:2222, or a whole ssh -p 2222 admin@server.example.com command, into Address fills in the user name and port for you. To check a host answers, right-click it and choose More > Test connection.

Hosts reached through one of your PCs can use any port too. The Console is free for Windows and Linux with up to 5 saved hosts: download RemoteAccessApp.