The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When two VPS servers cannot communicate, isolate the failure in this order: identify the exact source, destination, protocol and port; verify that the provider network and routes support the path; allow that traffic in cloud firewalls; test the TCP handshake; then check the destination listener, host firewall, DNS and application protocol. This layered approach distinguishes a missing route from a blocked port, a closed service and an application-level error without opening your servers to the whole internet.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start with a precise traffic statement
“The servers cannot communicate” is too broad to troubleshoot. A web request, an SSH session and a database connection can use different addresses, protocols and firewall rules. Pick one source VPS and one destination VPS first. Record the traffic you expect before changing anything.
As an Amazon Associate I earn from qualifying purchases.
Record both endpoints
| Item | What to write down | Why it matters |
|---|---|---|
| Source | VPS name, zone or region, private address and public address | Rules may match a private CIDR while DNS or an application uses a public address. |
| Destination | VPS name, zone or region, private address and public address | It confirms that the address being tested belongs to the intended instance. |
| Protocol | TCP or UDP | TCP handshake tests do not prove that a UDP service is reachable. |
| Destination port | The exact service port, such as the port used by SSH, HTTPS or your database | Firewalls and listeners are port-specific. |
| Expected path | Private network, peering, VPN or public internet | The route and security controls differ for each path. |
Use one source and one destination for the first test. Packet captures, connection counters and logs are much easier to interpret when only one flow is changing.
Verify provider network placement and routes
The guest operating system cannot create a path that the virtual network does not provide. Both VPSs must share a private network, or their separate networks must have an explicit peering or VPN relationship. Then the route tables must contain a usable route in both directions.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Same virtual network
Check that both instances are attached to the same VPC, VNet or equivalent private network and that their private addresses are in the ranges you expect. A server can have two interfaces or multiple subnets; confirm which interface owns the address in your traffic statement. Review subnet routes and any custom routes that could send the destination through the wrong next hop.
Peered networks
For peering, inspect the route table on each side. A route from the source subnet to the destination CIDR is required, and the destination side needs a return route to the source CIDR. AWS documents missing routes, security-group or network-ACL rules, and DNS resolving to the wrong address as common peering failures. Peering does not provide edge-to-edge routing through gateways, VPNs or internet gateways, so do not assume that a peering link can transit another network or perform NAT.
Check for asymmetric routing
A packet can arrive at the destination while the reply takes a different path and is discarded by a firewall or stateful device. Compare the forward and return routes for the two private CIDRs. If you recently changed a route, keep a console or serial-console path available: Google Cloud cautions that an incorrect route can disconnect a VM.
Google Cloud describes its Connectivity Tests feature this way: “Connectivity Tests analyzes the VPC network path configuration between two VMs and shows whether the programmed configuration should allow the traffic or not.” A reachability result describes programmed network behavior; it does not replace checking the service and host firewall on the destination.
Allow the flow in provider firewalls
Cloud firewalls, security groups and network ACLs are enforced outside the guest OS. A packet can be permitted by Linux and still be dropped before it reaches the VPS, or permitted by the provider and then dropped by the host.
Build a narrow rule
Create or verify a rule with all of these properties:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- The correct direction, usually ingress on the destination and egress on the source.
- The intended protocol, TCP or UDP.
- The exact destination port.
- The source private CIDR or source security-group identity, rather than an unrestricted internet range.
- The correct VPC, subnet, project, account or organization scope.
Google Cloud VPC firewalls have an implied ingress deny and egress allow behavior. In a non-default network, an explicit ingress allow is therefore needed for the intended source range and port. Other providers express the same controls through security groups, NACLs or organization-level policies; inspect every layer that applies to both instances.
Distinguish stateful and stateless controls
A stateful security group normally tracks an established connection, while a stateless network ACL may require rules for both the request and the return traffic. Read the provider’s evaluation order and priority rules before adding an allow. A higher-priority deny can make a correctly written lower-priority allow ineffective.
After changing one provider rule, repeat the same probe from the same source. Changing routes, cloud rules and host rules together makes it impossible to know which change fixed the path.
Test the TCP handshake from the source VPS
Run the test on the source VPS, not on your laptop. For a TCP service, use a verbose probe such as:
Recommended Free Tools
curl -vso /dev/null --connect-timeout 5 DEST_IP:DEST_PORTAn equivalent port check is:
nc -vz DEST_IP DEST_PORTReplace the placeholders with the destination address and port from your traffic statement. The probe is testing whether a TCP connection can be established; it is not authenticating to the application or proving that a request will succeed.
| Observed result | What it establishes | What to investigate next |
|---|---|---|
| Connection succeeds | The path, provider controls, host filtering and a listening socket allowed the TCP handshake. | Check application authentication, TLS, encryption settings, request syntax and whether you tested the correct application port. |
| Timeout | No response completed the handshake within the timeout. | Check the address, routes in both directions, silent provider or host-firewall drops, and asymmetric routing. |
| Connection refused or reset | Traffic reached the destination side, which actively rejected it. | Check whether a listener exists, whether the service is bound to the tested address, and whether an application or firewall is sending the rejection. |
A successful handshake does not mean the application is healthy. Conversely, a timeout is not proof that the process is down; a missing route or silent filtering can produce the same symptom.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Verify the destination listener and host firewall
Confirm that the service is listening
On a Linux destination VPS, inspect listening sockets with:
ss -lntupUse the service’s own status command as well. Confirm all three details:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- The process is running and listening on the expected port.
- The socket is bound to the destination’s private address or to an appropriate wildcard address, not only to loopback.
- The socket uses the protocol you are testing. A TCP listener does not accept UDP datagrams on the same number.
A service bound only to 127.0.0.1 accepts connections from the same VPS but not from its network interface. Binding to a private address or a suitable wildcard address makes remote access possible, subject to firewall policy. Avoid binding broadly when the service can use a specific private interface.
Inspect host-firewall policy and counters
Check the active firewall implementation on both VPSs. Common checks include:
ufw status
iptables -L -n -v -xIf another firewall is installed, use its native status and rule-display commands. Look for rules matching the source CIDR, protocol and destination port. Packet and byte counters are useful evidence: a counter that increases when you repeat the probe indicates that the rule is seeing the traffic. Google’s troubleshooting example shows counters increasing on a matching DROP rule and demonstrates source-restricted ACCEPT rules.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Inspect egress policy on the source as well as ingress policy on the destination. A locally generated packet can be blocked before it leaves, and a return packet can be blocked on the destination’s egress path.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Validate DNS and address family
If you connect by hostname, resolve it from the source VPS and compare every returned address with the intended private address. AWS lists incorrect DNS resolution as a VPC-peering failure cause. A record can point to an old instance, a public address or a different region even when the private network is configured correctly.
When a name has both IPv4 and IPv6 records, test each family separately. An unreachable IPv6 path or stale AAAA record can make a client appear to have an application failure while IPv4 works. Use your resolver’s address-listing command and the client’s IPv4- or IPv6-only option, then compare the results with the routes and firewall rules for that family.
For a clean diagnostic, first test the literal private IP. If the IP works but the hostname fails, focus on DNS records, split-horizon DNS, resolver configuration and address-family preference rather than changing the service firewall.
Reach a private-only VPS through a bastion
A private-only VPS has no public network interface and cannot be reached directly from the internet. DigitalOcean describes private Droplets this way: “Private Droplets have no public network interface and cannot be reached directly from the internet.”
Use a jump host
Place a bastion or jump host with a public address in the same VPC, or in a peered VPC with valid routes to the private server. Restrict SSH access to the bastion’s trusted administration sources. On the private VPS, allow SSH from the bastion’s private VPC address or narrowly defined CIDR, not from the entire internet.
The bastion is an administrative path; it does not automatically make every application port reachable. Add separate provider and host-firewall rules for the application traffic that must flow between the two VPSs.
Do not confuse NAT with inbound access
A NAT gateway can provide outbound internet access for a private VPS, but it does not accept unsolicited inbound SSH connections. If the destination is private-only, use the bastion, a routed VPN or another explicitly configured private connection.
When TCP works but the application fails
If the handshake succeeds, stop changing network routes and broad firewall rules. Move up the stack.
- Read the destination application log at the time of the test and check the source application log for its exact error.
- Verify that the client is using the service’s real port and protocol rather than a neighboring management or metrics port.
- For TLS, compare supported protocol versions, certificate expectations, server name indication and encryption settings.
- Check application-level authentication, authorization, allowed-source lists and database or API configuration.
- Confirm that the server process is accepting connections on the same interface that passed the handshake; a proxy may accept TCP while the upstream service is unavailable.
Firewalls alone do not protect credentials or data in transit. Use HTTPS or another TLS-protected protocol for application traffic, and use SSH forwarding or a SOCKS proxy when those are appropriate to the access pattern.
Investigate intermittent connections, stalls and UDP failures
Check MTU when transfers stall
When TCP connects but larger transfers stall, or when UDP is unreliable, compare the interface MTU on both VPSs with the MTU supported by the provider network. Google Cloud notes that mismatched MTUs are usually not an issue for TCP but can affect UDP. Do not lower MTU blindly; first establish which interface, tunnel or peering segment differs.
Separate loss from latency
Record whether failures are constant or intermittent and whether they affect one port, one address family or all traffic. Use the provider’s reachability and performance tools before changing routes. A latency spike, packet loss and a deterministic timeout point to different causes, so preserve timestamps while reviewing firewall counters and application logs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Apply fixes without creating a larger security problem
- Keep a console or serial-console session available before editing routes or firewall policy.
- Change one layer at a time: provider route, provider firewall, host firewall, listener configuration or application settings.
- Permit only the required source CIDR, protocol and destination port. Avoid a temporary internet-wide rule unless it is an isolated, time-limited diagnostic and you understand the exposure.
- Repeat the identical probe from the identical source after each change.
- Remove diagnostic rules that are no longer required and document the final route and rule dependencies.
- Use encryption or a secure forwarding method for sensitive traffic; a reachable port is not the same as protected data.
Choose the appropriate VPS-to-VPS architecture
| Architecture | Advantages | Requirements and limitations | Good fit |
|---|---|---|---|
| Private IPs on the same VPC/VNet | Traffic stays on the provider’s private network and rules can be limited to private CIDRs. | Both instances need compatible subnets, routes and provider/host firewall rules. | Services that communicate regularly inside one environment. |
| Peered private networks | Connects separate network domains without exposing the service publicly. | Routes are required in both directions; peering does not provide edge-to-edge gateway, VPN or internet-gateway transit. | Teams or projects that must retain separate network boundaries. |
| VPN or another routed private link | Can connect otherwise separate networks with explicit encryption and routes. | Requires tunnel endpoints, route management and monitoring; MTU may need attention. | Cross-network traffic that needs a controlled private path. |
| Public IPs | Works when no private relationship exists and is easy to test from the source VPS. | Exposes a service to internet-facing controls and requires tightly scoped firewall rules and encryption. | Short-term diagnostics or services intentionally designed for public access. |
| Bastion or jump host | Provides controlled administrative access to a private-only server. | Does not replace application routes or application-specific firewall rules; the bastion itself must be secured. | SSH administration of servers without public interfaces. |
End-to-end troubleshooting checklist
- Write down the source VPS, destination VPS, private and public addresses, protocol and destination port.
- Test the literal intended address from the source VPS before relying on a hostname.
- Confirm that both VPSs share a private network or have an explicit peering, VPN or routed relationship.
- Verify forward and return routes for the two private CIDRs and check for asymmetric routing.
- Review provider firewalls, security groups, NACLs and organization policies for the exact source range, protocol and port.
- Run the verbose TCP probe or equivalent port check from the source VPS.
- Classify the result as success, timeout or reset/refusal and follow the corresponding branch.
- On the destination, verify the process, listening address, port and protocol with
ss -lntupor the service’s status tool. - Inspect host-firewall rules and counters on both VPSs, including egress controls.
- Resolve the hostname from the source and force-test IPv4 and IPv6 when both exist.
- For a private-only destination, use a bastion in the same or peered VPC; do not expect a NAT gateway to accept inbound SSH.
- If TCP succeeds but the application fails, inspect logs, authentication and TLS or other higher-level protocol settings.
- For stalls or unreliable UDP, compare MTUs and use provider reachability or performance diagnostics.
- Keep the final rules narrow, encrypted where needed and documented after the connection is restored.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
