Proxy Connection Refused or Timeout: Causes & Fixes

Q: How do I test whether a proxy host and port are reachable?

Use telnet proxy.example.com 8080 or nc -zv proxy.example.com 8080. "Connected" means the port is open and your issue is elsewhere. "Connection refused" means the port is closed. A hang followed by timeout means a firewall is dropping your packets.

By Nicholas St. Germain — July 23, 2026

"Connection refused" and "connection timed out" look similar in a stack trace and mean opposite things. One is a fast, loud "no." The other is a slow, silent nothing. Reading which one you got tells you where to look before you change a single setting.

This guide separates the two, shows you how to prove which you're hitting, and walks the client, server, and network causes behind each.

"Connection Refused" vs "Timed Out"

Connection refused means something answered and actively rejected you. The packet reached a host and got an immediate "no." Connection timed out means nothing answered at all: your packets went into the void and the clock ran out. That distinction narrows the problem in half.

Refused (curl: (7) Failed to connect, ECONNREFUSED): a machine is reachable at that IP but nothing is listening on that port, or a firewall is sending an active reject. Fast failure, usually under a second.
Timed out (curl: (28) Connection timed out, ETIMEDOUT): packets are being dropped silently: a firewall that blackholes instead of rejecting, an unreachable host, or a route that goes nowhere. Slow failure, exactly as long as your timeout.

Refused points at the wrong port or a service that's down. Timed out points at a firewall, a bad route, or a network in between eating packets.

Common Causes

Client side:

Wrong host or port. A typo, or you're pointing at 8080 when the proxy listens on 3128.
Local firewall or antivirus blocking the outbound port.
Corporate or ISP network blocking non-standard proxy ports.
Timeout set too short for the round trip.

Server side:

The proxy node is down or in maintenance.
The node is overloaded and dropping new connections.
A firewall rule on the node's side.
The account or order is inactive, so the node rejects the session.

Network in between:

Packet loss or routing problems between you and the node.
ISP throttling or congestion at peak hours.
DNS failing to resolve the proxy hostname.

Diagnose Which One You Have

Don't guess. Prove it with three commands, in order.

1. Confirm the host resolves and responds at all. If the proxy is given as a hostname, resolve it first:

ping proxy.example.com

Ping tests the host, not the proxy port. A proxy node may block ICMP and still serve traffic fine, so a failed ping alone isn't proof of anything. Use it only to confirm DNS resolves and the host is roughly reachable.

2. Test the exact port. This is the decisive check. telnet (or nc) tells you whether anything is listening on the proxy port:

telnet proxy.example.com 8080
# or, if telnet isn't installed:
nc -zv proxy.example.com 8080

Three outcomes, three diagnoses:

Connected to proxy.example.com -> the port is open. Your problem is credentials or the request itself, not connectivity.
Connection refused -> something's there but the port is closed. Wrong port, or the service is down.
Hangs, then Connection timed out -> a firewall is dropping your packets, or the route is broken.

3. Run a verbose curl with a hard timeout. This shows exactly how far the connection gets:

curl -v -x http://username:password@proxy.example.com:8080 --max-time 10 https://httpbin.org/ip

A refused connection dies at the TCP layer:

*   Trying 203.0.113.10:8080...
* connect to 203.0.113.10 port 8080 failed: Connection refused
* Failed to connect to proxy.example.com port 8080 after 3 ms: Connection refused
curl: (7) Failed to connect to proxy.example.com port 8080 after 3 ms: Connection refused

A timeout hangs at "Trying" until --max-time fires:

*   Trying 203.0.113.10:8080...
* Connection timed out after 10001 milliseconds
curl: (28) Connection timed out after 10001 milliseconds

Note the timing: 3 ms for the refusal, 10001 ms for the timeout. That gap is the whole diagnosis in one number.

Fixes for Connection Refused

You got an active reject. Work the port and the service:

Double-check host and port against your dashboard, character for character. This fixes most refusals; a wrong port produces an instant refuse.
Test from a second network. Tether to your phone and rerun the curl. If it connects on cellular but refuses on your office Wi-Fi, a local firewall or corporate policy is blocking the port, not the proxy.
Check local firewall and antivirus. Some security suites silently block outbound connections to non-standard ports. Temporarily disable and retest.
Confirm the order is active in your dashboard. An expired or unprovisioned order means the node has no session for you.

Fixes for Connection Timed Out

You got silence. Attack the timeout, the firewall, and the retry logic:

Raise the timeout. A 5-second timeout is too aggressive for a cross-country round trip under load. Give it room:

curl -x http://username:password@proxy.example.com:8080 --max-time 30 https://httpbin.org/ip

Retry with backoff instead of hammering a slow node. In Python:

import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

proxies = {
    "http":  "http://username:password@proxy.example.com:8080",
    "https": "http://username:password@proxy.example.com:8080",
}

session = requests.Session()
retries = Retry(total=3, backoff_factor=1, status_forcelist=[502, 503, 504])
session.mount("https://", HTTPAdapter(max_retries=retries))

try:
    r = session.get("https://httpbin.org/ip", proxies=proxies, timeout=30)
    print(r.status_code, r.json())
except requests.exceptions.Timeout:
    print("Timed out - raise the timeout or the node may be overloaded.")
except requests.exceptions.ConnectionError:
    print("Could not connect - check host, port, and firewall.")

Catching Timeout and ConnectionError separately mirrors the refused-vs-timeout split: one tells you to wait and retry, the other tells you the address or firewall is wrong.

Rule out DNS. If the proxy is a hostname and it won't resolve, every connection times out. Test resolution directly:

nslookup proxy.example.com

Test the port through the firewall with nc -zv from the affected machine. If it hangs there but connects elsewhere, the firewall between you and the node is dropping packets.

When to Contact Your Provider

You've done your half when curl fails identically from two different networks with correct host, port, and an active order. At that point it's the node, not you. Before you open a ticket, collect:

The full curl -v --max-time 30 output (redact the password).
The telnet / nc -zv result on the proxy port.
Whether it fails from a second network too.

That turns a "my proxy doesn't work" ticket into a five-minute fix. Stat Proxies support can check node health and reprovision on the spot. Because our static ISP proxies hand you a dedicated IP rather than a shared rotating pool, "is the node up?" is a question with a definite answer, one endpoint to check instead of thousands.

Works Sometimes, Fails Others

Intermittent refused-or-timeout is the hardest flavor and almost always one of three things:

A single flaky node in a set. If you bought multiple IPs and only some fail, note which and send us the list.
Peak-hour congestion or ISP throttling. If failures cluster at the same time each day, the path is congested, not the proxy.
Concurrency too high. Firing hundreds of parallel connections can trip rate limits or exhaust local sockets, producing timeouts that vanish when you throttle. Cap concurrency and add a small delay between requests.

If the connection succeeds but the response is slow or the site blocks you, that's a different failure. Read why is my proxy slow or blocked. If you get a 407 instead of a refuse or timeout, the connection is fine and it's an auth problem, so see fix proxy 407 authentication errors. And to build a clean baseline test you can rerun any time, use our proxy testing walkthrough. Reliable connectivity matters most for long-running jobs like web scraping, where one dropped node can stall an entire crawl.

FAQ

What's the difference between connection refused and connection timed out?

Refused means a host answered and actively rejected the connection, usually the wrong port or a service that's down, and it fails in milliseconds. Timed out means nothing answered at all, whether a firewall dropping packets, a bad route, or an unreachable host, and it fails only after your timeout expires.

How do I test whether a proxy host and port are reachable?

Use telnet proxy.example.com 8080 or nc -zv proxy.example.com 8080. "Connected" means the port is open and your issue is elsewhere. "Connection refused" means the port is closed. A hang followed by timeout means a firewall is dropping your packets.

How long should a proxy timeout be?

For most requests through a static ISP proxy, 30 seconds is a safe ceiling. Under 5 seconds is too aggressive for a cross-country round trip under load and produces false timeouts. Raise it before you conclude a node is down.

Why does my proxy connect sometimes but not others?

Intermittent failures usually mean one flaky node in a set, peak-hour congestion or ISP throttling, or too many concurrent connections tripping rate limits. Note the timing and the specific IPs that fail, then throttle concurrency and retest.

Can a firewall block a proxy but not normal internet?

Yes. Firewalls and antivirus often allow ports 80 and 443 while blocking non-standard proxy ports like 8080 or 3128. If curl refuses on your office network but connects over cellular, a local or corporate firewall is the cause, not the proxy.