Resolving 'Connection Refused' on Azure VMs: Throttling & Network Diagnostics

Understanding the Error

When you encounter a Connection refused (or ECONNREFUSED in Node.js/Python) error while trying to connect to an Azure Virtual Machine, it explicitly means that the connection attempt reached a host, but the host actively rejected it. This is fundamentally different from a connection timeout, where packets are silently dropped. However, in the context of cloud infrastructure like Azure, 'connection refused' can also bubble up from intermediate load balancers or due to severe network throttling.

Common Error Messages

You might see errors like:

• ssh: connect to host 203.0.113.5 port 22: Connection refused
• curl: (7) Failed to connect to 203.0.113.5 port 80: Connection refused
• java.net.ConnectException: Connection refused (Connection refused)

Step 1: Diagnose Network Security Groups (NSGs)

Azure NSGs act as a virtual firewall for your VM. If an NSG rule denies traffic, Azure typically drops the packet (resulting in a timeout), but if the traffic reaches the VM and the OS firewall blocks it, or no service is listening, you get a refusal.

First, check the Effective Security Rules for the VM's Network Interface (NIC). This shows the actual rules applied after merging subnet and NIC-level NSGs.

Use the Azure CLI to verify IP flow:

az network watcher test-ip-flow \
  --resource-group MyResourceGroup \
  --vm MyVm \
  --nic MyVmNic \
  --direction Inbound \
  --protocol TCP \
  --local 10.0.0.4:80 \
  --remote 203.0.113.10:45678

Step 2: Investigate Azure VM Throttling and SNAT Port Exhaustion

If you are seeing intermittent Connection refused errors, especially on outbound connections to APIs or database services, you might be hitting Azure VM throttling limits, specifically SNAT (Source Network Address Translation) port exhaustion.

Azure Standard Load Balancers allocate a default number of SNAT ports per VM. If your application opens too many concurrent outbound connections (e.g., failing to use connection pooling), you will exhaust these ports.

Symptoms of SNAT Exhaustion:

• Intermittent connection failures.
• Azure Monitor metrics showing high SNAT Connection Count or Allocated SNAT Ports.

Resolution:

1. Implement Connection Pooling: Ensure your application reuses HTTP or database connections.
2. Use NAT Gateway: Assign an Azure NAT Gateway to your subnet. NAT Gateways provide up to 64,512 SNAT ports per public IP address and vastly reduce the risk of exhaustion.
3. Scale Out: Distribute the load across multiple VMs or use Virtual Machine Scale Sets (VMSS).

Step 3: Guest OS Configuration

If the Azure network layer allows the traffic, the issue is within the VM.

1. Verify the service is running and listening on the correct interface: Often, services default to listening on 127.0.0.1 (localhost) instead of 0.0.0.0 (all interfaces).

2. Check the Guest OS Firewall: On Linux, iptables, ufw, or firewalld might be blocking the port. On Windows, check the Advanced Security settings in Windows Defender Firewall.