Connection refused vs connection timed out

Likely causes

1. Refused: the service is not running, listens on another address or port, or a firewall rule says REJECT --reject-with tcp-reset.
2. Timed out: a firewall rule says DROP, a route is missing, or the host is down.

Diagnose

Run these in order. The output is what each printed on a lab's real Linux machines.

laptop:~# telnet 10.0.2.10 9

Nothing listens on port 9: the server's kernel answers the SYN with a reset, at once.

telnet: can't connect to remote host (10.0.2.10): Connection refused

scanner:~# curl -sS -m 5 http://webServer.lab/

A firewall drops port 80: no answer, so curl waits its 5 seconds and gives up.

curl: (28) Connection timed out after 5005 milliseconds

scanner:~# nmap -Pn -p 80 webServer.lab

nmap calls a dropped port filtered: no answer of any kind.

Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-13 15:59 UTC
Nmap scan report for webServer.lab (10.0.2.10)
Host is up.
rDNS record for 10.0.2.10: webServer

PORT   STATE    SERVICE
80/tcp filtered http

Nmap done: 1 IP address (1 host up) scanned in 2.06 seconds

scanner:~# curl -sS -m 5 http://webServer.lab/

The firewall now rejects with a reset: curl fails after 0 ms, exactly like a closed port.

curl: (7) Failed to connect to webServer.lab port 80 after 0 ms: Could not connect to server

scanner:~# nmap -Pn -p 22,80 webServer.lab

A rejected port and a really closed one look the same: closed.

Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-13 15:59 UTC
Nmap scan report for webServer.lab (10.0.2.10)
Host is up (0.000099s latency).
rDNS record for 10.0.2.10: webServer

PORT   STATE  SERVICE
22/tcp closed ssh
80/tcp closed http

Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds

Fix

firewallRouter:~# iptables -P FORWARD ACCEPT

For a timeout caused by your firewall: stop dropping. Here, the forward policy back to ACCEPT.

firewallRouter:~# iptables -S FORWARD
-P FORWARD ACCEPT
-A FORWARD -j NETLAB-FORWARD

iptables -D FORWARD -p tcp --dport 80 -d 10.0.2.10 -j DROP

Or delete the one rule that drops the port: -D with the rule exactly as iptables -S lists it.

The fix the lab's challenge "The website went dark" checks.

scanner:~# curl -s http://webServer.lab/

The page loads again.

hello from webServer

Break it and fix it yourself

Each lab is a small network of real Linux machines in your browser, where this fault happens.

• TCP and UDP: ports, connections and datagrams Free: its challenge "Connections to the echo service hang" set the fault for you to find and fix.
• Drop or reject: what a firewall tells a scanner Pro: its challenge "The website went dark" set the fault for you to find and fix.

Open TCP and UDP: ports, connections and datagrams