ERR_CONNECTION_REFUSED: what it means and how to fix it

What ERR_CONNECTION_REFUSED means

A TCP connection starts with a handshake: the client sends a SYN packet, and the server answers with SYN-ACK if a process is bound to that port. When no process is listening, the operating system's network stack sends back an RST packet instead, closing the attempt right away. That RST is what produces ERR_CONNECTION_REFUSED in Chrome and its equivalents in other browsers. The connection reached the target machine and got a clear no, which separates this error from a timeout, where nothing answers at all.

The RST reply comes from the kernel's TCP stack, not from any application code, which is why it arrives within a few milliseconds instead of after several seconds of waiting. This also means the machine itself is up and answering network traffic; it simply has nothing bound to the specific port the request targeted. That distinction matters when deciding where to look first: a refused connection points at the port and the process behind it, not at the server's power or its network link.

How the error appears

Chrome shows a plain "This site can't be reached ... ERR_CONNECTION_REFUSED" page with no further detail. Firefox reports "Unable to connect" and names the host and port it tried. The command line gives a more exact picture:

curl -v https://example.com:8443/
* Trying 203.0.113.10:8443...
* connect to 203.0.113.10 port 8443 failed: Connection refused
* Failed to connect to example.com port 8443 after 2 ms: Connection refused

The message names the exact port curl tried and reports the refusal within a couple of milliseconds, fast enough to rule out a timeout. telnet host port or nc -zv host port return the same "Connection refused" line.

What causes ERR_CONNECTION_REFUSED

• Nothing is listening on that port. The web server, application, or proxy that should be bound to the port is not running.
• The service stopped or crashed. A process that exited, was killed for using too much memory, or was stopped for maintenance leaves the port unbound.
• A firewall rule rejects the connection outright. A REJECT rule sends back the same RST a closed port would, so from the outside it looks identical to nothing being there.
• The wrong port is in the URL. A typo, an old bookmark from before a port change, or a service that moved to a different port all produce this error against the old port.
• A local development server is not running. localhost:3000 refused almost always means the dev server was stopped or never started in this terminal session.
• A proxy or VPN is misconfigured. A proxy pointed at a backend that is down, or a VPN client rewriting requests to a port nothing serves, refuses the connection on its own behalf.
• A container's port mapping does not match the application inside it. A Docker or Kubernetes service whose published port differs from the port the application actually binds to produces this error even though the process itself is running and healthy.

How to tell whose fault it is

If the site loads for other people right now, or loaded for you a minute ago, the problem is more likely local: a VPN, a proxy setting, or a firewall rule on your own machine or network. If it fails the same way from a phone on mobile data, the server side is refusing connections for everyone. Running an HTTP or port check from several locations at once settles this in one request; if checkpoints in multiple countries all report the connection refused, the cause is the server or its firewall, not your network.

How to fix ERR_CONNECTION_REFUSED

If you are a visitor

1. Confirm the URL and port. Check for a typo, an old bookmark, or a link that still points at a decommissioned port.
2. Disable your VPN or proxy and reload. If the site loads afterward, the VPN or proxy configuration is the cause; check its settings or contact whoever manages it.
3. Try a different network, such as mobile data instead of Wi-Fi, to rule out a local firewall or router rule.
4. Wait and retry. If the site owner is mid-deploy or restarting a service, the port may only be unbound for a few seconds.

If you run the site

1. Confirm the process is running and bound to the expected port:

   ss -ltnp | grep :443
   netstat -tlnp | grep :443

   An empty result means nothing is listening; start the service or fix its configured port.
2. Check the service status and logs:

   systemctl status nginx
   journalctl -u nginx -n 50

   A crashed or failed unit shows up here, often with the reason it exited.
3. Check the firewall for a REJECT rule on the port:

   iptables -L -n | grep REJECT
   ufw status verbose

   A REJECT rule looks identical to a closed port from the outside, so this step is easy to miss.
4. Confirm the service listens on the right interface. A server bound to 127.0.0.1 instead of 0.0.0.0 refuses every connection that arrives from outside the machine, even though it works fine from a local shell.
5. Restart the service once the configuration is fixed, and confirm the port is bound again with the same ss command before considering the issue resolved.

How to prevent ERR_CONNECTION_REFUSED

A crashed service or an accidental firewall rule usually shows up first as refused connections rather than as an alert from the server itself, since a process that is not running cannot report its own failure. Regular port monitoring catches this within minutes by connecting from outside the network the same way a visitor would, and sends an alert by email, SMS, voice call, Slack, Telegram and other channels the moment a check fails.

Related errors

• ERR_CONNECTION_TIMED_OUT happens when nothing answers the connection attempt at all, rather than actively refusing it.
• ERR_CONNECTION_RESET happens when a connection was accepted and then torn down partway through.
• This site can't be reached covers the full set of connection errors Chrome groups under one heading.

Frequently asked questions

Is ERR_CONNECTION_REFUSED the same as a firewall blocking me?

It can be. A firewall REJECT rule produces the same RST response as a closed port, so the two look identical from the browser. A DROP rule behaves differently and produces a timeout instead.

Why does this happen only on localhost?

Almost always because the local dev server is not running in that terminal, was stopped, or crashed on startup due to a code or configuration error. Check the terminal where you normally start it for an error message.

Can a VPN cause ERR_CONNECTION_REFUSED?

Yes. A VPN that routes traffic through a proxy or gateway can refuse connections on the gateway's behalf if its own backend is down, even though the actual destination server is healthy.

Does ERR_CONNECTION_REFUSED mean the website is down for everyone?

Not necessarily. Test from a second network or run a check from multiple locations before concluding that. A single misconfigured firewall rule or local VPN can produce the same error while the site works fine for everyone else.

What is the difference between refused and reset?

Refused means the connection attempt never completed; the target rejected it immediately. Reset means the connection was established and working, then torn down partway through, usually by something further along the path.

How do I find out which process should be listening?

Check the application's own startup logs and its configuration for the port it expects to bind. If the process is running but bound to a different port than the one the URL uses, either update the URL or the configuration so the two agree, then confirm with ss -ltnp that the port is now bound as expected.