nc/telnet hangs: firewall DROP vs REJECT Networking Origin: Network OSI layer 4 · Transport Last updated 5 Nov 2026

Networking: nc -vz hangs then times out — firewall silently DROPs packets (REJECT would answer "Connection refused")

A connection attempt gets no answer at all, which points to a firewall dropping the packets rather than a closed port.

Exact message you may see nc: connect to port (timed out)Connection timed out firewall droptelnet hangs on TryingOperation timed out firewall DROP vs REJECTport filtered
Explore the map of this error Full error map →
Seen on: Linux Networking

Meaning

"Connection refused" comes back instantly when a host or firewall REJECTs; a long hang then timeout means DROP or an unreachable path. Compare from another network, check security groups/NACLs/iptables/ufw, and use tcpdump on both ends to see whether SYN packets arrive.

Common causes

  • Firewall or security-group DROP rule
  • Cloud network ACL or NSG without an allow
  • Port closed with iptables DROP
  • Wrong IP or routing blackhole
  • Provider blocking the port

⚡ Quick fix

  1. nc -vz -w5 host port and note instant refuse vs hang
  2. Allow the port in the security group/firewall
  3. Capture: sudo tcpdump -ni any "tcp port 443 and host 1.2.3.4"

Detailed fix by platform

Linux

  1. bash
    nc -vz -w5 203.0.113.10 443
sudo iptables -L INPUT -n -v --line-numbers | head -30

How to diagnose

  1. Failure — Instant refuse or hang?
  2. SYN — Seen on server?
  3. Rule — DROP or REJECT?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

1020 — Cloudflare Error 1020: Access Denied (Cloudflare)102040615 — Azure SQL: Cannot open server 'x' requested by the login. Client with IP address 'y' is not allowed to access the server (Error 40615) (Azure)40615Cannot assign requested address (EADDRNOTAVAIL) — Networking: connect: Cannot assign requested address — ephemeral port range exhausted by TIME_WAIT connections (Networking)Cannot assign request…DNS lookups take 5 seconds (timeout then retry) — Networking: Every connection pauses about 5 seconds — resolv.conf nameserver timeout, then fallback to the next DNS server (Networking)DNS lookups take 5 se…ERR_CONNECTION_TIMED_OUT — ERR_CONNECTION_TIMED_OUT: This site can’t be reached — example.com took too long to respond (Browser)ERR_CONNECTION_TIMED_…ICMP Destination unreachable (Port unreachable) — Networking: ICMP Destination unreachable (Port unreachable) — UDP packet sent to a port where nothing is listening (Networking)ICMP Destination unre…Idle connections silently dropped by firewall/NAT — Networking: Connection works, then fails after being idle — firewall/NAT idle timeout dropped the TCP session (use keepalive) (Networking)Idle connections sile…Many sockets in CLOSE_WAIT — Networking: Thousands of sockets in CLOSE_WAIT — the application is not closing its side of the connection (Networking)Many sockets in CLOSE…nc/telnet…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.