Connection timed out (ETIMEDOUT)
ID: networking/connection-timeout
Version Compatibility
| Version | Status | Introduced | Deprecated | Notes |
|---|---|---|---|---|
| any | active | — | — | — |
Root Cause
The TCP connection attempt did not receive any response (SYN-ACK) within the timeout period. This typically indicates a firewall silently dropping packets, the host being down, or severe network congestion between client and server.
genericWorkarounds
-
85% success Diagnose the network path and fix firewall or routing issues
1. Verify basic connectivity: ping target-host 2. Trace the route: traceroute target-host (identify where packets stop) 3. Test specific port: nc -zv -w5 target-host PORT 4. Check local firewall: iptables -L -n | grep PORT 5. Check cloud security groups / network ACLs if in cloud environment 6. On the server side, verify iptables or nftables rules allow inbound traffic on the port 7. If behind NAT, verify port forwarding is configured
-
83% success Verify the target host is running and the service is listening on the correct interface
1. Confirm the host is up: ping target-host or check cloud console 2. On the server: ss -tlnp | grep :PORT to verify service is listening 3. Check if service binds to correct interface (0.0.0.0 vs 127.0.0.1) 4. Check if the host has correct default gateway: ip route show 5. Verify no IP blocklisting: check fail2ban, CSF, or cloud WAF rules 6. For cloud instances, verify the instance is in a running state and has a public IP if needed
Dead Ends
Common approaches that don't work:
-
Simply increase the TCP connection timeout to very large values
85% fail
If packets are being dropped by a firewall or the host is down, no amount of waiting will produce a response. Large timeouts cause applications to hang for extended periods, degrade user experience, and consume connection pool resources without resolving the underlying network issue.
-
Assume it is a DNS issue and change DNS servers
90% fail
ETIMEDOUT occurs after DNS resolution succeeds. The hostname has already resolved to an IP address; the failure is at the TCP level when the SYN packet gets no response. Changing DNS servers will not fix a firewall or routing problem between client and the resolved IP.