Connection refused
A reset came back where an acceptance should have been. This is the most informative failure a network can give you, because it proves things that silence never can.
What it looks like
Two packets: a SYN out, and a RST back. No SYN-ACK, no data, no retry that gets anywhere. The report grades the conversation Failed and says “Nobody was home — the door was locked”.
What it proves
Three things at once, and this is why a reset is good news. The host is up, because something generated the reset. The path works in both directions, because your SYN arrived and the reset came back. And a decision was made deliberately — nothing dropped it silently. Whatever is wrong lives at the destination, not in between.
What causes it
- Nothing is listening. The service is stopped, crashed, or was never started.
- It is listening somewhere else. Bound to 127.0.0.1 rather than the interface you reached, which is the single most common cause on a machine somebody just set up.
- A host firewall rejected rather than dropped. iptables with
REJECT, or firewalld's default, produces exactly this. - A load balancer with no healthy backend. It answers, then immediately gives up.
What to do
Go to the destination host and run ss -lntp (or netstat -lntp). If the
port is not listed, the service is down. If it is listed against 127.0.0.1, that is your answer.
If it is listening on the right address, the host firewall is rejecting: check
iptables -L -n or firewall-cmd --list-all. There is no point looking at
routing or at the network in between — the reset already proved both work.