# java.net.ConnectException: 连接被拒绝（Connection refused）在org.apache.kafka.clients.NetworkClient

- **ID:** `kafka/network-exception-connection-refused`
- **领域:** kafka
- **类别:** network_error
- **验证级别:** ai_generated
- **修复率:** 95%

## 根因

Kafka客户端无法与代理建立TCP连接，因为代理端口未监听或防火墙阻止了该端口。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Kafka 3.0.0 | active | — | — |
| Kafka 3.1.0 | active | — | — |
| Kafka 3.2.0 | active | — | — |
| Kafka 3.5.0 | active | — | — |

## 解决方案

1. ```
   Verify broker is listening on the correct port and address.
Command:
netstat -tlnp | grep 9092
# Should show LISTEN with Kafka process
# If not, check broker logs:
grep -i 'listener' /var/log/kafka/server.log
# Ensure listeners=PLAINTEXT://0.0.0.0:9092 in server.properties
# Restart broker:
kafka-server-stop.sh && kafka-server-start.sh -daemon config/server.properties
   ```
2. ```
   Check firewall rules and allow inbound traffic on port 9092.
Command:
sudo ufw status | grep 9092
# If not allowed:
sudo ufw allow 9092/tcp
# For iptables:
iptables -A INPUT -p tcp --dport 9092 -j ACCEPT
# Test connectivity from client:
telnet broker-host 9092
   ```

## 无效尝试

- **Change advertised.listeners to localhost** — If broker is on a different host, localhost prevents external connections; the issue is port, not hostname. (80% 失败率)
- **Increase request.timeout.ms in client config** — Timeout does not fix connection refusal; the TCP handshake fails immediately. (95% 失败率)
- **Disable SSL/TLS in broker config** — If broker expects SSL, disabling it causes auth errors; connection refusal is often port-based. (60% 失败率)