Two of the most common networking errors look identical from the outside — in both cases you can't reach the server. But they're opposites, and knowing which one you're looking at narrows the cause from dozens of possibilities to two or three.
Connection refused means something answered you and said no.
Connection timed out means nothing answered at all.
What's actually happening
Every TCP connection starts with a three-step handshake. You send SYN. The server replies SYN-ACK. You send ACK. Connection established.
What you see when that fails depends on where it broke:
- Server sends back an
RSTpacket → connection refused - Nothing comes back at all, and your machine eventually gives up → connection timed out
An RST is an active reply. Your packet reached a real machine, that machine processed it, and it deliberately rejected you. A timeout means your packet vanished somewhere and no reply ever arrived.
Connection refused
ERR_CONNECTION_REFUSED
curl: (7) Failed to connect to example.com port 443: Connection refused
ssh: connect to host 203.0.113.5 port 22: Connection refused
What causes it
Nothing is listening on that port. By far the most common cause. The host is up and reachable, but nothing is bound to the port you asked for. The service crashed, never started, or you're hitting the wrong port.
The service is bound to the wrong interface. A service listening on 127.0.0.1 accepts connections only from the machine itself. From anywhere else they get refused. To accept outside traffic it needs 0.0.0.0 or the server's actual IP.
This one catches everyone during development. Works perfectly on localhost, fails the moment someone else tries.
A firewall set to REJECT rather than DROP. Firewalls dispose of unwanted packets two ways. REJECT sends back an RST → refused. DROP silently discards → timeout. Most server firewalls use DROP; many consumer routers and corporate appliances use REJECT.
How to check
ss -tlnp # what's listening, and which process owns it
If your port isn't in that list, nothing is running. If it shows 127.0.0.1:3306 rather than 0.0.0.0:3306, you've found the bind-address problem.
Connection timed out
ERR_CONNECTION_TIMED_OUT
curl: (28) Failed to connect to example.com port 443 after 130000 ms
ssh: connect to host 203.0.113.5 port 22: Operation timed out
What causes it
A firewall silently dropping your packets. The most common cause by a wide margin. Security groups on AWS, firewall rules on GCP, NSGs on Azure. Your packet arrives, the rule matches, the packet is discarded, nothing is sent back.
Missing or misconfigured port forwarding. When the service sits behind NAT, traffic hitting the public IP has to be forwarded inward. Without that rule, packets reach the router and stop.
The host isn't reachable at all. Powered off, or the IP no longer points at it. A dynamic IP that changed overnight is a common culprit — and if that IP was in a whitelist somewhere, the whitelist now points at a stranger.
Your ISP blocks the port. Residential providers routinely block outbound 25 (SMTP), and sometimes 80, 443 and 445. The block is silent, so it shows up as a timeout rather than a refusal.
The shortcut
- Fails fast → refused → the host is alive, the service is the problem
- Fails slow (20–130 seconds) → dropped → a firewall, NAT rule or route is the problem
If you remember nothing else from this post, remember that. The speed of the failure tells you which half of the stack to stop looking at, before you even read the error text.
Common ports, common causes
Port 22 (SSH)
Refused usually means sshd isn't running, or it's listening on a non-standard port. Timed out usually means a security group never allowed your IP.
Port 25 (SMTP)
Refused means no MTA is listening. Timed out from a home connection is almost always your ISP blocking outbound mail — use port 587 with authentication instead.
Ports 80 and 443 (HTTP / HTTPS)
Refused means the web server is down. Timed out means a firewall never let you near it.
Ports 3306 (MySQL) and 5432 (PostgreSQL)
Refused is nearly always the bind address, since both ship listening on localhost only. Timed out means a firewall, or the database was never exposed.
Port 3389 (RDP)
Refused means the service is disabled. Timed out is usually the Windows Firewall profile, which blocks by default on public networks.
A practical order of checks
- Note whether the failure was fast or slow — this alone splits the problem in half
- Confirm DNS resolves to the IP you expect. If it doesn't, you're timing out against the wrong machine entirely
- Ping the host, keeping in mind many servers block ICMP, so silence here isn't conclusive
- Test the specific port from outside your own network — testing from the server bypasses every firewall between you and it
- If the port opens but the site still fails, the network layer is fine. Move up to the application
For step 4 I use an online port checker — full disclosure, that's a free tool I built — since the whole point is testing the path a real visitor takes, not the path from your own machine. A ping test covers step 3 the same way.
FAQ
Why does refused happen instantly but timeout take 30 seconds?
A refusal is an active reply, so the RST comes back at network speed. A timeout is the absence of a reply, so your system waits out a timer — typically 20 to 130 seconds depending on the OS and client.
Does connection refused mean the server is down?
Usually the opposite. Something on that machine was awake enough to reject you. The host is up; the specific service isn't listening on that specific port.
Why does it work locally but not from outside?
Almost always bind address or firewall. Test externally, not from the server.
Originally published at webtoolsrealm.com
Top comments (0)