Firewall troubleshooting
Start with the application
Record host, port, protocol and failure time. Confirm the running process and listener with ss -lnt on Linux or Get-NetTCPConnection -State Listen on Windows. Test on the server first, then another LAN device. If the service listens only on localhost, a router rule will not fix it.
Check every layer
Review the operating system firewall, cloud provider rules, router NAT and ISP filters. An allow rule at one layer does not override a block elsewhere. Compare WAN and public IP to investigate CGNAT. In dual stack, verify A/IPv4 and AAAA/IPv6 separately: they may point to servers with different rules.
Interpret the result
Open proves only the TCP handshake from the test source. Refused indicates a rejection response but does not identify who rejected it. A timeout is inconclusive about the cause. Compare firewall logs at the same time and retest after one change. Do not disable all protections. A TCP test does not prove application health or UDP availability.