How to determine Connection Refused Issue?

Question

We have a linux server which runs a java process(Hazelcast) on port 5701. However, we are facing issue while connecting to that server and it result in a Connection Refused issue. Below are the details:

We have 3 nodes. Two of the nodes, Node A and Node B connect to each other over port 5701 via telnet. However, there is a third node (Node C). When Node C tries to connect to Node A via telnet, it works. However, when Node C tries to connect to Node B via telnet it results in Connection Refused.

Here is the output from telnet:

Node A connecting to Node B

11:54:16 # telnet <node B hostname> 5701
Trying <node B hostname>...
Connected to <node B hostname>.
Escape character is '^]'.

Node C connecting to Node B

11:38:44 # telnet <node B hostname> 5701 
Trying <node B hostname>...
telnet: connect to address <node B hostname>: Connection refused

I checked the firewall status as well on Node B.

12:30:57 # firewall-cmd --list-all
public
  target: DROP
  icmp-block-inversion: no
  interfaces: 
  sources: 
  services: dhcpv6-client ssh
  ports: 5701/tcp 8089/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

Firewall status Node A

12:32:02 # firewall-cmd --list-all
public (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: ens160
  sources: 
  services: dhcpv6-client ssh
  ports: 5701/tcp 8089/tcp 8000/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

Firewall status Node C:

12:32:30 # firewall-cmd --list-all
public (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: ens160
  sources: 
  services: dhcpv6-client ssh
  ports: 8443/tcp 8089/tcp 5701/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

score 0 · Answer 1 · answered Jul 28 '20 at 09:48

This issue was because of the NAT design from the cloud provider which we were leveraging. Communication between Nodes within same AZ over Floating IPs was restricted which was causing the Connection Refused. Since, our DNS Alias always maps to the floating IP, we had to update the /etc/hosts on the Node C to map the private IP to the dns alias. The communication using private IP is allowed by the Cloud Provider within the same AZ and across AZs

How to determine Connection Refused Issue?

1 Answers1