Connection refused vs timed out vs no route to host
These messages describe where a connection attempt stopped, not a complete root cause. Use a short sequence of terminal checks to separate name resolution, routing, reachability, and listening-service problems.
Reviewed by the Terminaster editorial team · Updated
What you will take away
- Connection refused usually means the destination actively rejected the attempt.
- A timeout means the expected response did not arrive before the deadline.
- No route to host points toward a routing or reachability failure, but the wording alone is not proof of where it occurred.
- Record the resolved address, destination port, and protocol before changing a firewall or restarting a service.
Treat each error as evidence about a stage
A client first resolves a hostname, selects an address, finds a route, and then attempts a transport connection. An error can narrow that sequence, but it rarely identifies a single configuration mistake by itself.
Connection refused commonly follows an immediate TCP reset or an explicit network rejection. The host may be reachable while nothing is listening on that address and port. A firewall can also reject rather than silently drop traffic, so “the service is down” is a hypothesis, not a verdict.
A connect timeout means curl did not establish the connection within its limit. Packets may have been dropped, replies may have taken the wrong path, or the destination may simply be slow or unavailable. “No route to host” can come from the local routing table or from a reported network error upstream.
Capture one bounded connection attempt
Start with the exact URL that failed. Verbose curl output shows the addresses considered and the point at which the request stopped. Combine a short connect timeout with a total-operation timeout so both setup and a stalled transfer are bounded.
Keep credentials out of copied output. Verbose traces can contain Authorization, Cookie, proxy, and other sensitive headers.
- Note every “Trying” address and its port.
- Separate a DNS error from an error after an address was selected.
- Check whether IPv4 and IPv6 produce different results.
- Record whether failure was immediate or followed the timeout.
Observe resolution and connection setup
curl -v --connect-timeout 5 --max-time 15 \
https://example.com/ -o /dev/null
# Compare address families when both are published
curl -4 -v --connect-timeout 5 --max-time 15 https://example.com/ -o /dev/null
curl -6 -v --connect-timeout 5 --max-time 15 https://example.com/ -o /dev/nullCheck the client route and the server listener
On Linux, ask the routing table how it would reach the selected address. On a server you control, separately verify whether a process is listening on the intended port and address. These are different questions: a valid route does not prove that a service is listening, and a listener does not prove that the network permits traffic to reach it.
- 1Confirm the hostname resolved to the address you intended to test.
- 2Check that the client has a route for that address and the expected interface.
- 3On the destination, verify a listener exists on the expected port.
- 4Inspect whether it listens only on loopback, on one interface, or on a wildcard address.
- 5Only then inspect host, container, and network firewalls along that path.
Linux checks on each side
# On the client, use an address printed by curl
ip route get 203.0.113.10
# On the destination host
ss -ltnp
# Narrow the output without changing anything
ss -ltnp 'sport = :443'Choose the next test from the observed boundary
An immediate refusal with no server listener makes service configuration the next useful check. A listener bound only to 127.0.0.1 explains why a same-host request can work while a remote request fails. A timeout that affects one address family but not the other points toward family-specific routing, firewall, or listener configuration.
Avoid broad fixes such as disabling a firewall or restarting every network service. Change one layer only after a read-only check has made it the leading hypothesis, and repeat the same bounded request to verify the result.
Common questions
Frequently asked questions
Does connection refused prove the server is reachable?
It is evidence that an active rejection reached the client, but it does not prove the application server itself sent it. A host firewall or another device can reject the connection too.
Can a firewall cause both refused and timed-out connections?
Yes. A rule that rejects traffic can produce an immediate error, while a rule that silently drops traffic commonly leads to a timeout. Exact behavior depends on the protocol, rule, and network path.
Why does curl try an IPv6 address before IPv4?
The hostname may publish both address families, and the client follows its address-selection and connection strategy. Use curl -4 and curl -6 as diagnostic comparisons, not as a substitute for fixing a broken family.
Keep learning
Sources and next steps
Related mental models
IP address and network interface
A network interface is an operating-system attachment point for sending and receiving network packets, whether backed by hardware or software. An IP address and prefix assigned to an interface identify an IP endpoint and its on-link network within a particular network configuration.
Port and socket
A port is a 16-bit number in a transport protocol such as TCP or UDP. A socket is a kernel communication object that a process usually accesses through a file descriptor. An internet socket can bind to a local protocol, IP address, and port; a connected TCP socket also records the remote address and port.
TCP vs UDP
TCP provides applications with an ordered, reliable byte stream between connected endpoints and includes flow and congestion control. UDP sends individual datagrams with preserved message boundaries but does not itself guarantee delivery, ordering, duplicate suppression, or congestion control.