Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
ERR_CONNECTION_REFUSED means the TCP connection reached the requested address, but nothing accepted it on that port. The fastest fix is to work from the URL outward: verify the hostname resolves to the right server, confirm the intended service is running and listening on that exact address and port, then check NGINX or Apache bindings, logs, port conflicts, and network firewalls. A service listening only on 127.0.0.1, for example, can work locally while every remote client is refused.
Do not begin by changing random firewall or proxy settings. Record the URL, identify the process that should answer it, and collect evidence at each layer. The sequence below separates a dead service from a wrong port, wrong DNS destination, bad virtual-host configuration, and an external access rule.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What ERR_CONNECTION_REFUSED actually tells you
A web request normally starts with a TCP connection to one IP address and port. The browser reports ERR_CONNECTION_REFUSED when that connection is actively rejected because no process is accepting connections there, or because the host is configured to reject them. The error occurs before HTTP headers, application routing, authentication, or page content are exchanged.
That distinction narrows the investigation:
- Connection refused: check the listener, bind address, service state, port, and policies that reject the connection.
- Connection timed out: suspect a dropped packet, routing problem, security group, firewall, or an unreachable host rather than an ordinary missing listener.
- HTTP 502 or 504: a front-end web server accepted the connection but could not reach its upstream application.
- TLS or certificate errors: a service accepted the connection and began HTTPS negotiation; the problem is later than a refusal.
A refusal does not by itself identify whether NGINX, Apache, an application server, DNS, or a firewall is at fault. It identifies the address-and-port combination that failed.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Start by reading the URL literally
Write down every part of the failing URL before changing anything:
- Scheme:
httpnormally uses port 80 andhttpsnormally uses port 443 unless a port is shown. - Hostname: the name that must resolve to the intended machine.
- Explicit port: for example,
:8080or:8443. A service on 8080 will not answer a request sent to port 80 unless another listener or proxy forwards it. - Address family: the hostname may resolve to IPv4, IPv6, or both.
Test the exact combination, not a nearby one. Visiting http://example.test tests port 80; visiting https://example.test tests port 443; visiting http://example.test:8080 tests 8080. A successful test on one does not prove that another is configured.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check DNS before inspecting the web server
Resolve the hostname from the client that sees the error and compare the result with the server you administer. On a Unix-like client, typical commands are:
dig +short example.test
getent ahosts example.testOn Windows, nslookup example.test provides the same basic check. Look for an old address, a typo, an unexpected load-balancer address, or an IPv6 AAAA record that points somewhere different from the IPv4 A record. Test each returned address when more than one is present.
Apache documentation notes that the hostname must resolve in DNS for the server to be reachable. DNS can be correct while the service is still down, but DNS pointing to the wrong host makes every local configuration check on your intended machine irrelevant.
Prove which address the client is using
Use verbose connection output to see the destination and port:
curl -v --connect-timeout 5 http://example.test:8080/The output shows the address selected and whether the refusal occurs immediately. To bypass DNS temporarily, test a known address while preserving the Host header used by a virtual host:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
curl -v --resolve example.test:80:203.0.113.10 http://example.test/Replace the example address with the server’s actual address. If the direct address works but the hostname does not, focus on DNS, cached records, or the wrong address family. If both fail, continue to the listener.
Confirm the service is running and has the right listener
A running process is not enough. It must have a socket on the exact IP/interface and port in the URL. Check both service state and sockets on the server.
Check service state
On systems using systemd, inspect the relevant unit:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorssudo systemctl status nginx
sudo systemctl status apache2
sudo systemctl status httpdOnly one of the Apache unit names normally exists on a given distribution. For an application, substitute its service name or inspect the process manager that starts it. A failed, inactive, or repeatedly restarting unit explains a refusal; the status output usually points to the first useful log entry.
Inspect listening sockets
Use a socket listing to see the process, address, and port:
sudo ss -ltnpAlternatively, on systems with lsof:
sudo lsof -nP -iTCP:80 -sTCP:LISTEN
sudo lsof -nP -iTCP:443 -sTCP:LISTENLook for the port from the URL, not only 80 and 443. A line bound to 127.0.0.1:8080 accepts connections from the same machine only. A line bound to 0.0.0.0:8080 accepts IPv4 connections on the host’s interfaces, subject to firewall rules. An IPv6-only listener such as [::1]:8080 will not accept an IPv4 connection to 127.0.0.1.
If no line exists, start or repair the service before investigating DNS or browser settings. If a different process owns the port, resolve that conflict rather than starting another copy blindly.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Fix a loopback-only or wrong-interface bind
One of the most common self-hosting mistakes is binding the application to loopback while expecting remote access. Loopback addresses include 127.0.0.1 for IPv4 and ::1 for IPv6. They are useful for an application that should be reachable only through a local reverse proxy, but they cannot receive direct connections from another machine.
Decide which architecture you intend:
- Reverse-proxy design: the public web server listens on the public interface, while the application listens on loopback or a private network port. The proxy must point to that exact upstream port.
- Direct application access: the application itself listens on the server’s public or private interface and the firewall allows that port.
After changing a bind address, restart or reload the application using its documented service method, then verify the new socket with ss -ltnp. Do not expose an administrative or development port publicly unless it is intended to be public and protected appropriately.
NGINX: verify listen, host matching, and upstreams
In NGINX, the listen directive defines the IP address and port, or a Unix socket, on which a server block listens. A minimal block might contain:
server {
listen 127.0.0.1:8080;
server_name example.test;
location / {
proxy_pass http://localhost:8080;
}
}This example is intentionally local: it accepts only loopback traffic, and its proxy target must have an application listening on port 8080. For public HTTP traffic, the front-end block must listen on the address and port that receives that traffic, commonly port 80; for HTTPS, it must also have a listener on 443 and the required TLS configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check the three NGINX decisions
- Socket selection: NGINX first matches the request’s destination IP and port against
listen. If no block listens there, the connection cannot reach a server block at all. - Server-name selection: after the address and port match, NGINX uses the HTTP
Hostheader to choose among server blocks. If the name does not match, the default server for that port handles the request. - Upstream connection: if NGINX accepts the client connection but
proxy_passpoints to a stopped or wrong-port application, the symptom normally changes to an upstream error such as 502 rather than a client-side refusal.
Dump the active configuration, including included files, so you inspect what NGINX actually loaded rather than only an edited template:
sudo nginx -TCheck each relevant listen, server_name, and proxy_pass. A typo in an included file can leave the intended server block absent or prevent a reload.
Validate and apply NGINX changes
Validate syntax before applying it:
sudo nginx -tOnly after a successful test, reload the running process:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
sudo nginx -s reloadA configuration edit does nothing until NGINX is reloaded or restarted. If validation fails, keep the previous working configuration in place, correct the reported file and line, test again, and then reload. Check the access and error logs when behavior remains unexpected; their locations vary by distribution, but common paths are under /var/log/nginx/.
Apache: verify Listen before <VirtualHost>
Apache’s Listen directive determines the addresses and ports it accepts. A <VirtualHost> block does not create a socket by itself. Apache must first be listening on the matching address and port.
Listen 80
<VirtualHost *:80>
ServerName example.test
DocumentRoot /var/www/example
</VirtualHost>If the URL targets port 8080 but Apache has only Listen 80, the virtual host will never receive that request. Conversely, adding two overlapping Listen directives for the same address and port can make startup fail.
Inspect Apache’s effective configuration
Use the configuration-test command supplied by your installation, commonly:
sudo apachectl configtestOn some distributions, apache2ctl configtest is the equivalent. Then inspect enabled virtual hosts and listeners using your distribution’s Apache tools, and confirm the service unit is active. A fatal startup error is reported to the console or the configured ErrorLog.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Apache documents an “Unable to bind to Port …” failure as commonly caused by insufficient privilege or another web server already using the port. It also treats overlapping Listen directives as fatal. Resolve the owner of the port, remove the duplicate, or choose a deliberate architecture in which one front end proxies to another service.
Read logs before changing several settings
Logs tell you whether the service crashed, rejected a configuration, failed to bind, or reached an upstream that is unavailable. Apache’s guidance is direct: As an Apache HTTP Server administrator, your most valuable assets are the log files, and, in particular, the error log.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
For system-managed services, start with the unit journal:
sudo journalctl -u nginx -b
sudo journalctl -u apache2 -b
sudo journalctl -u httpd -bUse the unit that exists on your system. Then inspect the web server’s own error log and access log. NGINX commonly uses error.log and access.log; Apache’s paths are set by its configuration and may differ by virtual host.
What specific log messages mean
- Syntax or parse error: the new configuration was not accepted. Fix the named file and line, run the configuration test again, and reload only after it passes.
- Unable to bind, address already in use, or permission denied: inspect the socket owner and the service account’s privileges.
- Crash loop or repeated exit: repair the application or dependency that causes the process to terminate; restarting alone only repeats the failure.
- Connection refused to an upstream: the front end is alive, but its configured application address or port is wrong, or the application is down.
- No access-log entry at all: the request may not be reaching this server block, or the refusal occurs before HTTP is established.
Resolve port conflicts and privilege errors
Only one process can normally bind a given IP-and-port combination. If an old NGINX process, Apache instance, development server, container, or another application owns port 80, a second service cannot claim it. Use ss -ltnp or lsof to identify the owner, then choose one of these deliberate fixes:
- Stop and disable the unintended service.
- Move the application to an unused internal port and proxy to it.
- Move the front end to the required public port and update DNS, proxy, and firewall rules consistently.
- Correct a duplicate
Listenorlistendeclaration.
Ports below 1024 are privileged on typical Unix-like systems. A service started without the required capability may fail before creating its socket. Prefer the operating system’s service manager and its documented permissions rather than running a production web server manually as an unrestricted administrator.
Check host firewalls, cloud controls, and routing
When the service listens on the intended public interface and local requests succeed, test from a different network. A local success proves only that the process answers locally; it does not prove that packets can reach it from the Internet.
Check every policy layer that can reject or drop the connection:
- The operating system firewall and its allowed TCP ports.
- A cloud security group, provider firewall, or network access-control list.
- A hardware firewall, router port-forwarding rule, or NAT configuration.
- Routing to the server’s public address.
- Whether the service binds to the interface that owns the public address.
Use the provider’s current control panel to verify that the exact TCP port is allowed from the intended source ranges. Do not open every port as a diagnostic shortcut; allow only the port and sources required for the service.
Compare local and external tests
From the server, test the listener directly:
curl -v --connect-timeout 5 http://127.0.0.1:8080/Then test the server’s non-loopback address from the server, and finally test the public hostname from another network:
curl -v --connect-timeout 5 http://203.0.113.10:8080/
curl -v --connect-timeout 5 http://example.test:8080/Replace the examples with real values. A refusal locally means the service or bind is wrong. A local success followed by an external refusal points to interface binding, firewall, security-group, NAT, or routing. If an external request times out instead, investigate packet filtering and route reachability as well as the listener.
Quick Recap
Use this symptom-to-cause comparison
| Observed result | Most likely area | Next evidence to collect |
|---|---|---|
| Nothing is listening on the requested port | Stopped service, crash, wrong port, or failed startup | Service status, startup journal, configuration-test output |
| Listener exists only on 127.0.0.1 or ::1 | Loopback-only bind | Application bind setting and the front-end proxy design |
| Hostname resolves to an unexpected address | DNS record, cache, or wrong environment | dig/nslookup output and the server’s public addresses |
| IP works but hostname selects the wrong site | NGINX server_name or Apache virtual-host matching |
Host header test and effective virtual-host configuration |
| Local request works; remote request is refused | Firewall, security group, NAT, routing, or public-interface binding | External test, socket bind address, and network policy rules |
| Front end accepts connections but returns 502 | Reverse-proxy upstream is down or uses the wrong port | proxy_pass, application listener, and error log |
| Service will not start after an edit | Syntax error, duplicate listener, privilege problem, or occupied port | Configuration test, journal, and process/socket owner |
An ordered recovery procedure
- Copy the failing URL and record its scheme, hostname, and port.
- Resolve the hostname from the affected client; verify every returned address belongs to the intended server.
- On the server, check the service state and read the latest startup errors.
- Run
ss -ltnpand confirm a process listens on the exact requested port and an interface reachable from the client. - If no listener exists, repair the service configuration or start the service; do not proceed to firewall changes until a local listener is present.
- For NGINX, inspect
listen,server_name, andproxy_pass; for Apache, inspectListenand<VirtualHost>. - Validate the configuration, apply it with a reload or restart, and verify that the listener remains present.
- Resolve any port owner conflict or permission failure reported by the service.
- Test from the server, then from another network, comparing the exact address and port each time.
- Only after local and external listener tests pass should you troubleshoot application-level responses, certificates, redirects, or content.
Prevent the refusal from returning
- Keep the service under a process manager that restarts it and records failures.
- Monitor the expected listening port and alert when the socket disappears.
- Validate NGINX or Apache configuration in deployment automation before reloads.
- Document which component owns each public port and which internal port each proxy target uses.
- Keep DNS records, firewall rules, and service bind addresses synchronized when a server’s address changes.
- Retain enough error-log history to identify the first failure in a restart loop.
- Test from outside the host after changes that affect interfaces, security groups, NAT, or DNS.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
