networking firewall ai_generated true

Connection timed out: no route to host (firewall DROP)

ID: networking/firewall-blocked

Also available as: JSON · Markdown
88%Fix Rate
90%Confidence
75Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

A firewall (local iptables/nftables, cloud security group, or network ACL) is silently dropping or actively rejecting packets. DROP rules cause timeouts; REJECT rules return ICMP unreachable or TCP RST.

generic

Workarounds

  1. 90% success Identify which firewall layer is blocking and add the appropriate allow rule 
    1. Check local firewall: iptables -L -n -v or nft list ruleset
2. Look for DROP/REJECT rules matching the traffic: iptables -L -n | grep -i drop
3. Test with traceroute or mtr to identify where packets are dropped
4. In cloud: check security groups, NACLs, and route tables
5. Add an allow rule: iptables -I INPUT -p tcp --dport PORT -s SOURCE -j ACCEPT
6. Verify: nc -zv host PORT
  2. 85% success Use nmap to determine if the port is filtered vs closed 
    1. Scan the target port: nmap -p PORT host
2. 'filtered' = firewall dropping packets (no response)
3. 'closed' = host responds with RST (no service listening)
4. 'open' = service is accepting connections
5. Use traceroute to find where the filter exists: sudo traceroute -T -p PORT host
6. Check each hop's firewall rules as needed

Dead Ends

Common approaches that don't work:

  1. Increase TCP connection timeout to wait longer for the firewall to pass the packet 95% fail

    A DROP rule silently discards the packet. No amount of waiting will get a response — the packet is gone. Increasing timeout only delays the inevitable failure.

  2. Disable the local firewall without considering other firewall layers 60% fail

    Cloud environments have multiple firewall layers (security groups, NACLs, WAFs). Disabling the host firewall does not help if the block is at the cloud infrastructure level.

Error Chain

Leads to:
Preceded by:
Frequently confused with: