iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Fix VPS-to-VPS communication by troubleshooting the path in layers: identify the exact source and destination addresses, confirm that the provider network routes between them, allow the required traffic in cloud and host firewalls, then verify that the destination service is listening. A TCP timeout, refusal, and successful handshake each point to a different layer, so the result of one precise probe is more useful than changing several settings at once.
Start with a precise traffic record
Before editing a route or firewall rule, write down one test flow. Record the source VPS name and zone or region, its private and public addresses, the destination VPS and both addresses, the protocol, and the destination port. Test one source and one destination first; this keeps packet captures, firewall counters, and service logs understandable.
| Item | What to record | Why it matters |
|---|---|---|
| Source | VPS name, region or zone, private IP, public IP | Rules and routes often match a source CIDR, not a hostname. |
| Destination | VPS name, region or zone, private IP, public IP | Using a public address when a private path is intended can send traffic through a different policy or route. |
| Protocol | TCP or UDP | A successful TCP test does not prove that a UDP service is reachable. |
| Port | Destination port, such as the application’s listening port | SSH on port 22 can work while the application port remains blocked. |
| Expected path | Same private network, peering, VPN, or public internet | The provider must have a route and policy for that specific path. |
Keep the test narrow: one source, one destination address, one protocol, and one port. Once that flow works, test additional instances or ports.
Confirm that the VPSs have a valid provider path
Same VPC or VNet
Two instances can communicate over private addresses only when their interfaces belong to the same virtual network, or when the provider supports a correctly configured connection between their networks. Check the network, subnet, region or zone, and interface attached to each VPS. A shared label or similar private address does not create connectivity by itself.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Peering, VPN, or another inter-network connection
If the VPSs are in different virtual networks, verify that the networks are explicitly peered or connected through a supported private link or VPN. Review route tables in both directions. A route from source to destination without a return route produces an incomplete or asymmetric path and commonly appears as a timeout.
AWS documents that VPC peering failures commonly come from missing routes, security-group or network ACL rules, or DNS resolving to the wrong address. Peering also does not provide edge-to-edge routing through gateways, VPNs, private connections, or internet gateways. Treat peering as a private route between the participating networks, not as a general transit service.
Recommended Free Tools
Read the route tables both ways
For the destination private CIDR, confirm a next hop on the source VPS’s network. Then confirm that the destination network has a return route to the source CIDR. Inspect every route table associated with the relevant subnets; a route in an unused table does not affect the interface that carries the packet.
Do not make several route changes together. Keep a provider console or serial-console path available first, because an incorrect route can disconnect the VPS you are repairing.
Allow the flow in provider firewalls
Cloud firewalls, security groups, and network ACLs operate outside the guest operating system. A rule in ufw or iptables cannot compensate for a provider firewall that drops the packet earlier.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Use the narrowest rule
Create an ingress rule on the destination for the required protocol and port, with the source restricted to the other VPS’s private IP or private CIDR. Add a corresponding egress rule only when the provider’s policy requires explicit egress permission. Check organization-level or project-level policies as well as instance-level rules.
Google Cloud describes VPC firewalls as applying between instances, with an implied ingress deny and egress allow behavior. On a non-default network, an explicit ingress allow is therefore required for the intended source, protocol, and port. The exact rule model differs by provider, but the troubleshooting principle is the same: verify the effective policy, not merely a rule you remember creating.
Check both directions and both rule types
- Destination ingress allows the source private range and destination port.
- Source egress permits the protocol and destination range.
- Network ACLs do not block the forward or return traffic.
- Rules are attached to the actual interfaces or subnets used by the two VPSs.
- No higher-priority deny or organization policy overrides the allow.
Do not open a database or administration port to the entire internet merely to test it. A temporary broad rule can mask the real source range and create an unnecessary exposure.
Test the TCP handshake from the source VPS
Run the probe from the VPS that initiates the connection, using the destination address you intend the application to use:
curl -vso /dev/null --connect-timeout 5 DEST_IP:DEST_PORTAn equivalent netcat probe is:
nc -vz DEST_IP DEST_PORTThe five-second limit in the curl example prevents a broken path from hanging indefinitely. Repeat the identical command after each single change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
| Probe result | What it establishes | Next investigation |
|---|---|---|
| Connection succeeds | Packets reached a listening endpoint and the TCP handshake passed provider and host filtering. | Inspect the application protocol, authentication, TLS settings, request format, and whether the client is using the right port. |
| Timeout | No usable response arrived before the deadline. | Check the address, routes in both directions, silent provider drops, host-firewall drops, and asymmetric routing. |
| Connection refused or reset | The destination was reached, but a listener, application, or firewall actively rejected the connection. | Verify the daemon’s bind address and port, service state, and explicit reject rules. |
A successful handshake proves reachability only through TCP setup. It does not prove that an HTTP request, database login, TLS negotiation, or application message will succeed.
Verify the destination listener and guest firewall
Confirm the service is listening on the intended interface
On a Linux destination VPS, list listening sockets:
ss -lntupCheck the service’s native status command as well. Confirm three details: the process is running, it listens on the expected port, and it is bound to the destination’s private address or an appropriate wildcard address. A daemon bound only to 127.0.0.1 accepts local connections but cannot accept traffic arriving on the private interface.
Also verify that the service is using the protocol you are testing. A UDP listener will not complete a TCP handshake, and a TCP probe cannot validate a UDP-only service.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Inspect host-firewall rules and counters
Use the firewall actually installed on the VPS. Common checks include:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
ufw status
iptables -L -n -v -xLook for a rule that matches the source address, protocol, and destination port. Packet and byte counters are especially useful: a counter that increases when you repeat the probe indicates that traffic reached that firewall rule. A matching DROP counter points to a guest-firewall decision; no counter change suggests that the packet was stopped earlier or sent to a different interface or address.
Inspect the host firewall on both VPSs. Return traffic can be blocked even when destination ingress is allowed. Make the smallest source-restricted ACCEPT rule needed, then repeat the same probe.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCheck DNS and IPv4/IPv6 selection
If the application uses a hostname, resolve it from the source VPS and compare every returned address with the intended private address. AWS lists incorrect DNS resolution as a common VPC-peering failure cause. A record can still point to an old public address, a different instance, or an unreachable network.
When both IPv4 and IPv6 records exist, force-test each family separately. An unreachable IPv6 path or stale AAAA record can make a client appear to fail even though IPv4 works. Configure the application or DNS so it selects the address family that has a valid route and firewall policy, rather than assuming the first answer is usable.
Reach a private-only VPS through a bastion
A private-only VPS has no public network interface and cannot be reached directly from the internet. DigitalOcean describes private Droplets this way. If administration or application access must originate outside the private network, use a bastion or jump host with a public address in the same or a peered VPC.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Required bastion path
- Place the bastion in the same private network as the target, or in a network with valid two-way peering routes.
- Restrict inbound SSH on the bastion to the administrators’ trusted addresses.
- Permit SSH from the bastion’s private IP or VPC CIDR to the target’s private address and SSH port.
- Keep the target’s SSH service private; do not add a public ingress rule just to bypass a missing route.
- Use the bastion for forwarding or administration, and monitor its authentication logs.
A NAT gateway is not a substitute for a bastion. It provides outbound access for private instances but cannot accept inbound SSH connections.
If TCP works but the application still fails
Once the handshake succeeds, stop changing network routes and firewall rules. Move up the stack. Read the destination application’s logs at the time of the request and compare the client and server configuration.
- Confirm that the client is using the same port and protocol that the daemon exposes.
- Check TLS versions, certificate validation, encryption requirements, and server-name settings when the service uses TLS.
- Verify application authentication, authorization, credentials, and permitted source addresses.
- Check whether the service expects a particular client port, request framing, or connection sequence.
- Compare the application’s resolved hostname with the address used by the successful low-level probe.
A TCP success followed by an application error is not evidence that the private network is broken. It shows that the network delivered the connection far enough for the service or its protocol to respond.
Investigate MTU, packet loss, and UDP-specific behavior
When a TCP connection opens but large transfers stall, or when UDP appears intermittent, compare the interface MTU on both VPSs with the provider network’s supported MTU. Google Cloud notes that mismatched MTUs are usually not a problem for TCP but can affect UDP. A path that handles a handshake may still mishandle larger packets or fragmented datagrams.
For intermittent loss or high latency, use the provider’s reachability and performance tools before changing routes. Correlate those results with service logs and firewall counters. UDP does not provide a handshake result equivalent to TCP, so test the actual application exchange and interpret an absent response alongside packet captures or provider diagnostics rather than treating a single netcat result as conclusive.
Choose the right communication architecture
| Architecture choice | Advantages | Risks or requirements | Best fit |
|---|---|---|---|
| Private IPs in one VPC/VNet | Traffic stays on the provider’s private network and can be limited to private CIDRs. | Both interfaces, routes, and firewall policies must belong to the same network. | Services that communicate inside one provider environment. |
| Peered networks | Private addressing across separate networks without exposing the service publicly. | Two-way routes and policies are required; peering is not a general gateway or transit path. | Teams or environments that must remain separately administered. |
| VPN or another private connection | Connects otherwise separate networks through an intentional private tunnel. | Both tunnel endpoints, routes, encryption settings, and firewall rules must be healthy. | Cross-network traffic where direct peering is unavailable or unsuitable. |
| Public IPs | Works when no private connection exists and the provider permits the path. | Greater exposure; public firewall rules, address changes, and encryption become critical. | Short-term or externally initiated access when a private route cannot be provided. |
| Bastion or jump host | Keeps a private target off the internet while providing controlled administrative access. | The bastion becomes a protected entry point that needs its own patching, logging, and restricted rules. | SSH or forwarding into private-only VPSs. |
For sensitive traffic, use TLS or HTTPS, SSH forwarding, or a SOCKS proxy as appropriate. Firewalls control who can connect; they do not encrypt credentials or application data in transit.
Apply changes safely and prove each fix
- Save the original state. Note route tables, effective provider firewall rules, host-firewall rules, listener output, and the exact probe result.
- Keep an out-of-band console available. Route or firewall mistakes can remove network access, including SSH.
- Change one layer. Correct the provider route, provider firewall, host firewall, listener, or DNS record separately.
- Repeat the same probe. Use the same source, destination address, protocol, port, and timeout so the result is attributable.
- Confirm the return path. A forward allow without a return route or return firewall permission is not a complete fix.
- Remove temporary broad rules. Replace test access with the narrow source CIDR and required destination port.
- Validate the application. After TCP or UDP reachability is established, perform the real protocol exchange and check logs.
Symptom-to-check guide
| Symptom | Most useful checks |
|---|---|
| Both private IPs time out | Confirm shared network or peering, both route-table directions, provider ingress policy, and host-firewall DROP counters. |
| Public IP works but private IP fails | Inspect private-interface attachment, private CIDR routes, private firewall source rules, and whether DNS returns the wrong address. |
| SSH works but the application port times out | Test the application port directly; verify its listener, provider ingress rule, host firewall, and bind address. SSH success validates only the SSH path. |
| Connection is refused immediately | Check whether the service is running and listening on that interface and port; inspect explicit reject rules. |
| Connection opens, then TLS or login fails | Leave network rules unchanged and inspect TLS versions, encryption, certificates, credentials, authorization, and application logs. |
| Hostname fails but an IP works | Resolve the name on the source VPS, compare A and AAAA results, and correct stale or incorrect DNS records. |
| TCP transfers stall or UDP loses packets | Compare MTUs, check provider reachability and performance tools, and test the actual application exchange. |
| Private target cannot be reached from the internet | Use a bastion in the same or peered VPC; a NAT gateway supports outbound traffic but not inbound SSH. |
Final security checklist
- Prefer private addresses for east-west service traffic when a valid private path exists.
- Allow only the necessary source CIDR, protocol, and destination port at the provider and guest layers.
- Keep administration on a bastion or private path instead of exposing the target publicly.
- Use TLS, HTTPS, SSH forwarding, or another suitable encryption layer for credentials and data.
- Record which rule and route changed, and remove temporary diagnostic access after testing.
- Retest from the real application client after every network fix; a handshake alone is not an application-health check.
The reliable sequence is endpoint, provider path, provider policy, handshake, listener, host firewall, name resolution, and finally application protocol. Following that order identifies whether the packet never arrived, was rejected on the destination, or reached the service and failed for an application-specific reason.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
