Ssh – how to make standard ssh port a stealth port

firewallserver-settingssshstealthtcpip

I'm running a personal ssh server on a nonstandard port. If someone tries to log into my ssh server thru the standard port 22, it seems that the server sends "Connection refused" message.

$ ssh localhost
ssh: connect to host localhost port 22: Connection refused

How can I make it so that it doesn't send such message and it behaves like it's not running?

Best Answer

The server is not sending anything, it's the client telling you the server refused the connection. That's the expected behaviour if a TCP port is closed when you try to connect.

If you want your system to silently drop packets without sending a "this port is closed" TCP answer (a so-called stealth port), you need to use a firewall on the system and/or in between it and the client.