Ports and sockets
Reaching a host isn't the same as reaching a service. Two checks:
On the server: is anything listening? ss (socket statistics, the replacement for netstat):
ss -tlnp: TCP, listening, numeric, with process names (needs root to see other users' processes). Use-ufor UDP.- The local address matters:
0.0.0.0:80listens on every interface, but127.0.0.1:80only accepts connections from the machine itself. That's a classic cause of "works locally, not remotely".
From the client: does a connection succeed? nc -vz host port tries a TCP handshake without sending data. The way it fails tells you where to look:
| Result | What happened | Look at |
|---|---|---|
succeeded | Handshake completed | The application itself |
Connection refused | The host answered with a TCP reset: reachable, but nothing listening on that port | Is the service running? Right port? Bound to the right address? |
timed out | Nothing came back at all | A firewall silently dropping, a routing problem, or the host is down |
In the lab, port 8080 has no listener (refused), and port 8443 is dropped by an nft rule on the server (timed out).
root@server:~# ss -tlnp
State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0 4096 127.0.0.11:33523 0.0.0.0:*
LISTEN 0 5 0.0.0.0:80 0.0.0.0:* users:(("python3",pid=23,fd=3))
root@client:~# nc -vz -w 3 198.51.100.20 80
Connection to 198.51.100.20 80 port [tcp/http] succeeded!
root@client:~# nc -vz -w 3 198.51.100.20 8080
nc: connect to 198.51.100.20 port 8080 (tcp) failed: Connection refused
root@client:~# nc -vz -w 3 198.51.100.20 8443
nc: connect to 198.51.100.20 port 8443 (tcp) timed out: Operation now in progress- Line 3: Docker's internal DNS listener inside the container. On a normal host you'd see services such as sshd here instead.
- Line 4: The web server: listening on every address (0.0.0.0) on port 80, owned by python3 with PID 23.
- Lines 5–6: The handshake completed: the network and the service are both fine.
- Lines 7–8: Refused: the server's kernel answered with a reset, because nothing listens on 8080. The network path is fine.
- Lines 9–10: Timed out: an nft rule drops packets to 8443, so nothing ever comes back. It looks exactly like a routing problem from here.
Interactive: Three ways a connection can end The same nc test against three ports on the server. What comes back, if anything, tells you where to look. (needs JavaScript)
Check your understanding
A new service works with curl http://localhost:8080 on the server, but remote clients get "Connection refused". What does ss -tlnp most likely show?
- Nothing listening on 8080
- A listener on 127.0.0.1:8080 instead of 0.0.0.0:8080
- A firewall dropping port 8080
- A routing problem