Reference guide · website-errors · Published 2026-08-16 · 3 min read
Connection refused vs connection timed out
Connection refused vs timed out, how each maps to a firewall, dead server or slow app, with the test that separates them.
- ·Refused means a no
- ·Timeout means silence
- ·The separating test
A connection refused error and a connection timed out error sound similar but report opposite facts about the network. Refused means a host answered and declined to connect. Timed out means no one answered at all. The distinction is the whole diagnosis, because each points to a different layer: a firewall, a dead service, or a congested route.
Refused means a no
A refused verdict (ERR_CONNECTION_REFUSED with a TCP RST) appears when the client reaches the host but nothing is listening on the requested port, or a firewall actively rejects the connection with a RESET. The server is reachable at the network level; it just does not accept the socket.
Common causes:
| Cause | Typical result |
|---|---|
| No service on that port | Port closed, nothing listens |
| Service stopped or crashed | Host is up, port is dead |
| Firewall rejects with RST | The box answers "no" |
| Wrong port in config | A different port is serving |
Because the answer comes back fast, a refused error is usually quick to appear, and it points at the application or the port, not the route.
Timeout means silence
A timed out verdict (ERR_TIMED_OUT or ERR_CONNECTION_TIMED_OUT) means the client sent its request and waited with no reply until the attempt gave up. Silence can sit at several hops: the DNS did not answer, the route to the host dropped packets, a firewall dropped the request rather than rejecting it, or the server accepted the connection but never completed the response.
Where refused implies the endpoint exists, a timeout leaves the location of the block open. The connection timed out article walks the route to find it.
The separating test
Use a single probe to state which one you have:
curl -v --connect-timeout 10 https://example.com/Watch the outcome:
Connection refusedprinted bycurlmeans the host answered with a reset. Inspect the port and the service.Connection timed outor a hang until the connect timeout means silence. Trace the route and DNS.Connection resetmid-exchange is a different fault again, where the server accepted the connection but the stream died (see connection reset).
To identify the port precisely on Windows, probe it directly:
Test-NetConnection example.com -Port 443This reports TcpTestSucceeded true (the port is open), false with refused, or hangs on a dropped firewall that silently filters the port.
Turning the verdict into a fix
| Verdict | First command | Most likely fix |
|---|---|---|
| Refused | Check the port and service | Start the service, bind the port, or open it |
| Timed out on connect | Trace the route | Fix DNS, firewall, or routing |
| Timed out after connect | App and database | Fix the slow query or upstream |
A firewall that silently drops packets produces a timeout, while one that answers with RESET produces a refused error, so the same firewall intent shows up in two different browser messages depending on how the filter is set. When a service sits behind a load balancer or CDN, start from the edge: the Cloudflare 522 article shows a timeout at the origin behind a CDN, and the general site not loading guide keeps the whole diagnostic in order.