Connection timed out in Linux: Causes and Quick Fix

What Does the "Connection timed out" Error Mean

The Connection timed out error (often displayed as the system code ETIMEDOUT or error 110) occurs when your system sends a connection initialization packet but receives no response from the remote server within a specified period. Unlike Connection refused, where the server explicitly rejects the request, here the response simply never reaches the client. You may encounter this message when using curl, wget, or ssh, in web server logs, or when working with package managers like apt and dnf.

Example of the full terminal output:

curl: (28) Connection timed out after 30001 milliseconds

Common Causes

The issue is rarely related to corrupted system files. In most cases, it stems from network routing or configuration issues:

• Outbound traffic blocked by a firewall. Built-in tools like ufw or firewalld, as well as corporate gateways, may silently drop packets without sending ICMP responses.
• Incorrect DNS settings. The system cannot resolve the domain name or is using an unreachable caching server.
• ISP-level routing issues. Packets get stuck at an intermediate node that neither forwards them nor returns a TTL-expired error.
• Incorrect port or IP address. The server is running, but not on the requested port, while NAT or a firewall silently drops the traffic.
• Overly restrictive Linux kernel parameters. Values for net.ipv4.tcp_retries2 or tcp_syn_retries may be too low for unstable or congested networks.

Troubleshooting Steps

Method 1: Verify Route and Host Reachability

Start with diagnostics to pinpoint where the connection drops. Open a terminal and run the following checks in sequence:

1. Check basic connectivity: ping -c 4 example.com. If the output shows 100% packet loss, the issue lies at the routing or IP address level.
2. Trace the packet path. Install the mtr utility (or use traceroute):

   sudo mtr --report example.com
   

   If the drop occurs at your ISP's hop, contact their support. If packets reach the target server but don't return, proceed to check ports and firewall rules.

Method 2: Diagnose the Local Firewall

Often, the system firewall silently drops outbound connections. Temporarily disable it for testing:

• For Ubuntu/Debian: sudo ufw disable
• For RHEL/Fedora: sudo systemctl stop firewalld

Try running the command that previously triggered the error. If the connection succeeds, add an allow rule instead of leaving the firewall disabled:

sudo ufw allow out 443/tcp
sudo ufw reload

💡 Tip: After testing, always re-enable the firewall using sudo ufw enable or sudo systemctl start firewalld to avoid leaving your system exposed.

Method 3: Flush DNS and Change the Resolver

If the issue only occurs when using a domain name but works with a direct IP address, DNS is the culprit. Edit the configuration as follows:

1. Open the /etc/resolv.conf file in a text editor:

   sudo nano /etc/resolv.conf
   

   Replace the existing nameserver lines with public DNS servers:

   nameserver 1.1.1.1
   nameserver 8.8.8.8
   

2. If systemd-resolved is active on your system, restart the service to apply the changes correctly:

   sudo systemctl restart systemd-resolved
   

Verify connectivity using curl -I https://example.com.

Method 4: Adjust OS-Level Timeouts

On unstable networks or under high load, the default wait time for SYN packet responses may be insufficient. Increase the limits via sysctl:

# View current retry value
sysctl net.ipv4.tcp_retries2

# Set a longer wait time (default is usually 15)
sudo sysctl -w net.ipv4.tcp_retries2=20
sudo sysctl -w net.ipv4.tcp_syn_retries=6

To persist these settings across reboots, add the lines to /etc/sysctl.conf and run sudo sysctl -p.

Prevention

To prevent the error from recurring, monitor network interfaces using netstat -tuln or ss -tuln to track ESTABLISHED and TIME_WAIT states. Regularly update kernel security packages and nftables/iptables, as updates frequently fix connection descriptor leaks. If you work with external APIs, always set explicit timeouts in your client libraries (e.g., timeout=10 in Python requests) to avoid relying on global system parameters and to receive clear exceptions instead of hanging processes.