Azure SFTP Connection Disconnects on Port 22 from Linux VM

The failure is most likely in the network path or SSH path from the Linux VM, not in the Storage SFTP endpoint itself, because the Windows-B VM can connect successfully.

Use this troubleshooting path:

1. Verify port 22 reachability from the Linux VM
   • From the Linux VM, confirm the destination is reachable on SSH port 22.
   • If the connection drops immediately after authentication starts, compare the path from Linux VM versus Windows-B VM.
2. Check NSG rules on the Azure VM and subnet
   • In Azure portal, open the VM that hosts the traffic path.
   • Go to Networking.
   • Confirm there is no rule blocking TCP 22.
   • Review rule priority carefully. Lower numbers are matched first, so an earlier deny rule can override later allow rules.
   • Also verify the default rules such as Allow VNet Inbound and Allow Load Balancer Inbound where applicable.
3. Check effective security rules
   • In the VM troubleshooting flow, review effective security rules to confirm an inbound Allow rule exists for SSH port 22 and that it has higher priority than any deny rule.
   • This is important in private and site-to-site topologies where subnet, NIC, or inherited rules can differ between VMs.
4. Check routing
   • In Azure portal, go to the VM’s Networking settings.
   • Select the network interface, then Effective routes.
   • Look for a user-defined route sending traffic to an unexpected next hop, such as an NVA or firewall appliance.
   • In a site-to-site setup, asymmetric routing or a forced-tunnel route can cause disconnects from one VM while another VM still works.
5. Check the Linux VM firewall and SSH client path
   • Temporarily disable the Linux VM firewall and test again.
   • If the connection works, re-enable the firewall and correct the rules.
   • Also verify the Linux VM can establish SSH traffic normally and that no local filtering is interfering.
6. Check whether the SSH service is listening on the expected port when troubleshooting Linux-side SSH behavior
   • If the issue involves the Linux VM’s own SSH handling or a nested/private path, use:

          sudo systemctl status sshd.service
          sudo ss --listen --tcp --process --numeric | grep sshd
     

   • This confirms whether SSH is active and which port is in use.
7. Use Azure network diagnostics
   • Use IP flow verify to confirm whether an NSG rule is blocking traffic.
   • Use Next hop to confirm routing is correct.
   • These checks help isolate whether the disconnect is caused by security filtering or route redirection.
8. Compare the working and failing VMs
   • Since Windows-B works and Linux VM fails, compare:
     • effective NSG rules
     • effective routes
     • local firewall behavior
     • whether both VMs use the same DNS resolution and same private endpoint path
     • whether one VM is behind a different NAT, appliance, or Hyper-V virtual switch path

If the issue is only from the Linux VM and the Storage private endpoint is reachable, the most likely causes are:

• an NSG or firewall rule affecting TCP 22
• a route difference in the site-to-site path
• local Linux-side filtering or SSH path differences

References:

• Connect to a Linux VM
• Troubleshoot SSH connections to an Azure Linux VM that fails, errors out, or is refused
• Troubleshoot Azure VM connectivity problems
• Troubleshoot connectivity problems between Azure virtual machines