"Connection timed out" means your request never received any response at all — different from "connection refused," which means the target actively rejected the connection. This guide covers diagnosing the difference and finding the actual cause.
Timed Out vs Refused: Why It Matters
| Error | What It Means |
|---|---|
| Connection refused | The target IP was reached, but nothing is listening on that port, or the connection was actively rejected |
| Connection timed out | The request received no response at all — the packet was likely dropped somewhere (firewall, routing, or the host being unreachable) |
Step 1 — Test Basic Connectivity
ping YOUR_SERVER_IPIf ping also times out, the issue is likely network-level, not specific to the service you're trying to reach.
Step 2 — Test the Specific Port
nc -zv YOUR_SERVER_IP 443Or:
telnet YOUR_SERVER_IP 443Step 3 — Check the Local Firewall
sudo ufw statusA timeout (as opposed to an immediate refusal) is the classic signature of a firewall silently dropping packets rather than rejecting them — confirm the required port is explicitly allowed.
Step 4 — Check for a Network-Level Firewall (Cloud Security Group)
Many hosting providers offer an additional network-level firewall separate from the OS firewall — check your provider's control panel for security group or network firewall rules that might be blocking the port before it even reaches the VPS's own ufw/iptables.
Step 5 — Confirm the Service Is Actually Running and Listening
sudo ss -tulpn | grep :443If nothing is listed, the service isn't running or isn't bound to the expected interface.
Step 6 — Check If the Service Is Bound to the Wrong Interface
A service bound only to 127.0.0.1 won't be reachable externally, even with a correctly configured firewall:
sudo ss -tulpn | grep SERVICE_NAMELook for whether it shows 127.0.0.1:PORT (local only) versus 0.0.0.0:PORT (all interfaces).
Step 7 — Check for Outbound Port Blocking (When Connecting FROM the VPS)
If your VPS itself can't reach an external service (e.g. port 25 for outbound email), some providers block specific outbound ports by default to prevent abuse:
nc -zv external-service.com 25Contact your provider to confirm and request the port be unblocked for legitimate use if needed.
Step 8 — Check DNS Resolution
A DNS resolution failure can sometimes present as what appears to be a connection timeout:
dig +short target-hostname.comCommon Scenarios
| Scenario | Likely Cause |
|---|---|
| SSH connection times out | Firewall blocking the SSH port, or wrong port specified |
| Website times out for visitors | Port 80/443 blocked, or web server not running |
| Application can't reach an external API | Outbound firewall rule or provider-level port block |
| Database connection times out from another server | Database bound to localhost only, or firewall not allowing the remote IP |
Related Articles
- VPS Unreachable/Can't Connect via SSH: Troubleshooting Guide
- How to Configure UFW Firewall on a Linux VPS
- Website Down? A Step-by-Step Troubleshooting Checklist
