Connection refused error

Quick answer: "Connection refused" means your packets reached the server but nothing is listening on that port — or a firewall actively rejected them. Check that the service is running and listening on the right port with ss -tlnp, then check firewall rules. It is almost never a network outage: a refusal is a real answer from the machine.

Overview

Unlike a timeout (packets vanish), a refusal is immediate and explicit. That is good news: the server is up and reachable, so the fault is a stopped service, a changed port or a reject rule.

Before you start

• Access to the server — via SSH on another port if one works, otherwise the KVM Console.
• The service and port you expect to reach (SSH 22, HTTP 80, HTTPS 443, MySQL 3306...).

Step-by-step guide

1. See what is actually listening:

   sudo ss -tlnp

   Look for the port in the local-address column and the owning process at the end of the line.
2. If the service is missing, check and start it:

   sudo systemctl status nginx
   sudo systemctl start nginx
   sudo journalctl -u nginx -n 30

   (Substitute sshd, mariadb, etc.) A service that dies right after start usually logs the reason — config error, port taken or full disk.
3. If the service listens but you are still refused, check the firewall:

   sudo ufw status verbose

   A reject rule produces refusals; add an allow rule for the port.
4. Confirm the service binds the public IP, not only localhost — 127.0.0.1:3306 in ss output means remote connections can never work (that is often intentional for databases).

Common issues

• Config typo: nginx/sshd refuse to start after an edit — run nginx -t or sshd -t to see the exact line.
• Port already in use: two services fighting for one port; the journal names the conflict.
• Service crashed earlier: full disk and OOM kills silently stop daemons — see out of disk space and high RAM diagnostics.

When to contact support

If everything listens correctly, the firewall allows the port and connections are still refused from outside while working locally (curl http://127.0.0.1), open a ticket with your ss -tlnp and firewall output.

Frequently asked questions

What exactly causes a connection refused response?

Either no process is listening on the target port or a firewall sends an active reject. Check listeners with ss -tlnp and firewall rules with ufw status verbose to see which one applies.

The service shows as listening — why am I still refused?

It may bind only to localhost (127.0.0.1), so remote connections never reach it, or a reject firewall rule intercepts the port. Both are visible in ss output and firewall listings.

Related articles

• Cannot connect via SSH
• Website shows 502 Bad Gateway
• Server is out of disk space
• How to collect logs for support

Need a hand? Contact Cloud2Y support →