ERR_CONNECTION_REFUSED means your browser reached the server’s address, but the server actively turned the connection away: nothing was listening on that port, or a firewall rejected it. DNS worked, so the name is fine. The problem is the web server, the port, or a firewall.
If you are visiting the site
- Check the address. A typo in the port, such as
example.com:8080, orhttp://where the site only offershttps://, can be refused. - Try another network. If the site loads on your phone with mobile data, your network, VPN or firewall is blocking it. Switch off the VPN or proxy and retry.
- Clear your DNS cache in case your device has an old address for the site: see how to flush your DNS cache.
- Check proxy settings. A proxy configured in your system or browser that is no longer running gives this error on every site.
If it fails everywhere, the site is down and only its owner can fix it.
Refused, timed out or not found?
| Error | What happened | Look at |
|---|---|---|
ERR_CONNECTION_REFUSED | Server answered “no”: nothing listening, or a firewall rejected it | Web server and firewall |
ERR_CONNECTION_TIMED_OUT | No answer at all: server off, wrong IP, or a firewall silently dropping traffic | Server, IP, firewall |
DNS_PROBE_FINISHED_NXDOMAIN | The name does not exist in DNS | DNS records |
If you run the site
1. Does the domain point at this server?
Make sure visitors are reaching the right machine before debugging it:
dig example.com +short
curl -4 ifconfig.meRun the second on the server. The two IP addresses must match. After a move, DNS pointing at the old, now switched-off server is a common cause.
2. Is the web server running?
sudo systemctl status nginx
sudo systemctl status apache2Use httpd instead of apache2 on RHEL-based systems. If it is stopped, test its configuration, then start it and read why it stopped:
sudo nginx -t
sudo systemctl start nginx
sudo journalctl -u nginx -n 30 --no-pagerA web server that fails to start usually says why in the last few lines: a configuration typo, a missing certificate file, or Address already in use (step 4).
3. Is it listening on the right port?
sudo ss -ltnp | grep -E ":80 |:443 "You should see the web server on both port 80 (HTTP) and 443 (HTTPS). If 443 is missing, HTTPS is not set up, and https:// addresses are refused while http:// works. Check there is a listen 443 ssl; line in the site’s configuration, or set up a certificate: see how to get a free SSL certificate with Let’s Encrypt.
If it shows 127.0.0.1:80 instead of 0.0.0.0:80 or *:80, the server only accepts connections from itself. Change the listen line so it does not name 127.0.0.1.
4. Is something else using the port?
Address already in use when starting the web server means another program holds port 80 or 443, such as Apache and Nginx both installed, or a leftover Docker container:
sudo ss -ltnp | grep ":80 "The output names the process. Stop and disable whichever one you do not want:
sudo systemctl disable --now apache25. Is a firewall rejecting it?
Test from the server itself, then from outside:
curl -I http://localhost
curl -I http://YOUR_SERVER_IPIf the first works but visitors are refused, a firewall is in the way. Check the server’s own firewall:
sudo ufw status
sudo firewall-cmd --list-allThe first is Ubuntu, the second AlmaLinux, Rocky and RHEL. Open the web ports if they are missing:
sudo ufw allow 80,443/tcp
sudo firewall-cmd --permanent --add-service=http --add-service=https && sudo firewall-cmd --reloadYour cloud provider may also have a firewall outside the server, called a security group (AWS), a firewall (DigitalOcean, Vultr, Hetzner) or network rules. Check ports 80 and 443 are allowed there too. See how to set up a firewall on Linux.
6. An app behind the web server
If you open an app directly on its own port, such as example.com:3000, the app must be running and listening on all addresses, not just 127.0.0.1. Usually the better setup is to keep the app private and put Nginx in front of it as a reverse proxy. If Nginx is in front and the app is down, visitors see a 502 Bad Gateway rather than a refused connection.
Confirm it is fixed
From your own computer, not the server:
curl -I https://example.comHTTP/2 200 means it works. Test http:// too, which should redirect to HTTPS.
Related
Something out of date? Software changes. If a step no longer works, tell us and we will check it and update the page.
