Port reference
Port 22 (TCP) – SSH
Secure Shell — encrypted remote login, command execution, and tunneling.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on most Linux/Unix servers and network devices by default. Frequently exposed to the internet for remote administration.
What is port 22 used for?
Port 22 is the standard port for SSH (Secure Shell), the encrypted protocol for
remote login, running commands on another machine, and secure file transfer. The
most common software is OpenSSH on Linux and macOS, with clients like PuTTY,
WinSCP, FileZilla, and the built-in ssh, scp, and sftp tools. It is the
default way to administer almost any Linux server, router, or network device.
When would you open it?
Open or forward port 22 when you need to reach a machine remotely, such as managing a home server or VPS, pushing files with SCP/SFTP, or accessing a device on your network from outside. Only open it if you actually run an SSH server and genuinely need remote access to it.
Is it safe to open?
The main risk is automated password guessing, so use key-based authentication, keep OpenSSH updated, and prefer a VPN or IP allowlist over exposing it openly. See the security notes below.
How to check if this port is open
ss -tulpn | grep :22
nmap -p 22 <target>netstat -ano | findstr :22
Test-NetConnection <host> -Port 22lsof -i :22
nmap -p 22 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 22 to your device's local IP, internal port 22, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 22/tcpsudo firewall-cmd --permanent --add-port=22/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 22" -Direction Inbound -Protocol TCP -LocalPort 22 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying
- Default and weak credentials on appliances/IoT
- Stolen or unmanaged private keys
- User enumeration and version-specific CVEs (e.g. CVE-2024-6387 'regreSSHion')
Hardening
- Disable password auth — use key-based or certificate auth
- Disable root login (PermitRootLogin no)
- Rate-limit and lock out with fail2ban or equivalent
- Restrict by IP allowlist / bastion host; consider a non-default port to cut noise
- Keep OpenSSH patched and enforce MFA
How to block this port
sudo ufw deny 22/tcpsudo firewall-cmd --permanent --remove-port=22/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 22 -j DROPNew-NetFirewallRule -DisplayName "Block 22" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Blocknmap snippet
nmap -p22 --script ssh2-enum-algos,ssh-auth-methods <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is it safe to expose port 22 to the internet?
- With key-only auth, no root login, rate limiting, and patched OpenSSH it can be acceptable, but a bastion or VPN is safer. Password auth on 22 is heavily brute-forced.
- Why is port 22 constantly scanned?
- SSH grants a remote shell, so it's a high-value target. Botnets continuously spray default and leaked credentials against every open 22.