Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsNginx error 111 means the Nginx worker reached the configured upstream address but could not complete a TCP connection because the target socket refused it. The client normally receives HTTP 502 Bad Gateway. Start with the exact upstream: host and port in the error log, then test that socket from the same host or container network namespace as Nginx. This separates a stopped service, wrong listener, container-local localhost, address-family mismatch, firewall rule, and configuration typo.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What “connect() failed (111: Connection refused)” means
A typical Nginx error entry includes a message such as:
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →connect() failed (111: Connection refused) while connecting to upstream,
upstream: "http://127.0.0.1:8080/api"Error 111 is an operating-system connection-refused result. Nginx attempted the IP address and port shown in the log, but no accepting socket completed the connection. The failure occurs before the application can process an HTTP request. Nginx therefore returns a gateway error, most often 502 Bad Gateway, to the client.
The upstream: value is the first diagnostic clue. It tells you the protocol, address, port, and often the request path that Nginx selected. Test that exact destination rather than a different URL that happens to work from your browser.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Log result | What happened | First direction to investigate |
|---|---|---|
111: Connection refused |
The target path was reached, but the destination actively rejected the connection because no suitable listener accepted it. | Process state, listening port, bind interface, address family, and policy rules. |
110: Connection timed out |
Connection packets were silently dropped or the host/path could not be reached before the timeout. | Routing, packet filtering, security groups, network policy, and host availability. |
A running application is not proof that the upstream is reachable. It may be listening on another port, bound only to a loopback interface, exposed on IPv4 while Nginx chose IPv6, or isolated in another container network.
Read the error log before changing anything
Find the error entry matching the failed request and record its timestamp. Copy the complete upstream: address, including its protocol and port. If an upstream group is configured, note which peer was selected. This prevents troubleshooting the wrong service or a stale configuration value.
- Protocol:
http://,https://, or another scheme indicates how Nginx is expected to speak to the backend. - Host or IP: this is the address Nginx actually resolved or used.
- Port: test this number, not the port used by a browser-facing listener.
- Path: useful for identifying the application route, but a refusal happens before path handling by the backend.
- Peer selection: repeated failures on one member of an upstream group may point to a single unhealthy backend rather than the whole service.
Inspect the configuration Nginx has loaded, not merely the file you think it reads:
sudo nginx -TSearch the output for every proxy_pass, fastcgi_pass, uwsgi_pass, scgi_pass, and memcached_pass destination, as well as every upstream block. A typo, an old port, or an included file can leave the running configuration different from the file you recently edited.
Eight-step diagnostic sequence
- Capture the exact failure. Read the matching error-log line and copy the
upstream:address, protocol, port, and timestamp. - Validate Nginx syntax. Run
sudo nginx -t. A successful syntax check only proves that the configuration can be parsed; it does not prove that any backend is listening or reachable. - Inspect listeners on the backend host. Run
sudo ss -tlnpon the machine or namespace where the application runs. Confirm that the expected process owns the expected port and that the local or non-local interface is correct. - Test the socket from Nginx’s network location. From the Nginx host, or from inside the Nginx container, run
nc -zv <host> <port>. If netcat is unavailable, an equivalent shell check such astimeout 3 bash -c '</dev/tcp/<host>/<port>'can test TCP establishment. A refusal here reproduces the Nginx failure without involving proxy configuration. - Check container or cluster topology. If either component is containerized, verify that they share a routable network and that service discovery resolves to the intended address. Replace container-local
localhostwith the Docker Compose service name or Kubernetes Service DNS name where appropriate. - Review access controls. Check the backend host firewall, cloud security group, network ACL, and Kubernetes network policy for traffic originating from the Nginx host or pod.
- Remove address-family ambiguity. If the destination is
localhost, test both127.0.0.1and[::1]explicitly. Use the address family on which the backend actually listens. - Evaluate upstream-group behavior. Inspect repeated failures, passive health state, and the availability of other peers. A failed member may be masked temporarily when another peer can serve the request.
Run the direct TCP test from the same network namespace as Nginx. A successful test from your laptop or from the backend host does not establish that Nginx can reach the socket.
Cause and fix: the backend stopped, crashed, or was killed
If ss -tlnp shows no listener on the configured port, determine why the service stopped before repeatedly restarting it. Check the service manager, container status, pod events, recent application logs, and operating-system records for a crash or out-of-memory kill. Deployment ordering can also produce a brief refusal when Nginx starts before its backend.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Checks
- Confirm the service, container, or pod is running.
- Review the most recent crash, restart, and out-of-memory records.
- Verify that the application completed startup and did not bind only after a failed migration or dependency check.
Fix
Repair the underlying startup or resource problem, then start the backend and confirm its listener with ss -tlnp. Add deployment readiness and ordering controls where available. Retries can reduce a short startup race, but they do not repair a port that remains closed.
Cause and fix: wrong port or bind address
The process may be healthy while listening on a different port or interface. For example, an application configured for port 8081 will refuse connections sent to 8080. A process bound only to 127.0.0.1 accepts connections from its own host but not from a separate Nginx host or container.
Checks
Compare the listener reported by ss -tlnp with the port and address in the loaded Nginx configuration. A listener such as 127.0.0.1:8080 is loopback-only; a listener such as 0.0.0.0:8080 accepts IPv4 connections on the host’s interfaces, subject to firewall rules.
Fix
Make both sides describe the same reachable socket. Either change the Nginx upstream port to the application’s actual port, or configure the application to listen on the intended interface and port. Bind broadly only when the host’s security policy permits it; otherwise use a private interface or service network and restrict access with firewall rules.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Cause and fix: container or Kubernetes localhost mistakes
127.0.0.1 and localhost refer to the current network namespace. Inside an Nginx container, 127.0.0.1 is that Nginx container, not a sibling application container and not the physical host. The same principle applies to a Kubernetes pod: loopback reaches containers in that pod, not a separate pod.
Docker and Compose
Use the Compose service name on the shared application network, for example:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
upstream app_backend {
server app:8080;
}
server {
location / {
proxy_pass http://app_backend;
}
}Here, app must be the service name resolvable by the Nginx container, and port 8080 must be the port exposed inside that network. Publishing a host port for browser access does not change the address that a sibling container should use.
Kubernetes
Point Nginx at the Kubernetes Service DNS name and the Service port, rather than at another pod’s loopback address. Confirm that the Service has ready endpoints and that its selector matches the application labels. A Service with no ready endpoints can produce connection failures even when an individual pod process appears healthy.
Fix
Place the workloads on a shared, routable network, use service discovery, and verify the destination from inside the Nginx container or pod. Do not substitute localhost merely because the application works when tested from its own container.
Cause and fix: IPv4 and IPv6 localhost mismatch
Name resolution can select IPv6 loopback [::1] while the backend listens only on IPv4 127.0.0.1. The reverse can also occur. The result is a refusal that appears inconsistent because one address family works and the other does not.
Checks
Test each address explicitly from the Nginx environment. For HTTP, use an address-appropriate request such as curl -v http://127.0.0.1:8080/ and, where supported, curl -v http://[::1]:8080/. Compare those results with the listeners shown by ss -tlnp.
Fix
Replace ambiguous localhost with the explicit working address in the upstream definition, or configure the backend to listen on the required address family. Keep bracket notation around an IPv6 literal in a URL.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Cause and fix: firewall, ACL, security group, or network policy
A policy can block Nginx even when the backend is listening. Host firewalls, cloud security groups, network ACLs, and Kubernetes network policies may allow local tests while denying traffic from the Nginx source address. Depending on the policy, you may see a refusal or a timeout.
Checks
- Identify the source address used by Nginx, not the address of an administrator’s test machine.
- Inspect inbound rules on the backend host and outbound rules on the Nginx host.
- Review cloud security-group membership and Kubernetes network-policy selectors.
- Repeat the direct TCP test after any policy change.
Fix
Permit only the required backend port from the Nginx source network, then retest. Avoid opening the service to every address as a diagnostic shortcut unless the exposure is temporary and controlled.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Cause and fix: stale or incorrect upstream configuration
Nginx may still be using an old included file, a misspelled hostname, the wrong port, or an inappropriate pass directive. For HTTP reverse proxying, proxy_pass accepts a hostname or IP and an optional port. A URI included in proxy_pass also changes the URI portion sent upstream, so check both the destination and path behavior.
Other backend protocols use their corresponding directives:
Recommended Free Tools
| Backend protocol | Nginx directive | What to verify |
|---|---|---|
| HTTP or HTTPS | proxy_pass |
Hostname, port, scheme, and any URI component. |
| FastCGI | fastcgi_pass |
FastCGI listener address and port or Unix socket. |
| uWSGI | uwsgi_pass |
uWSGI protocol endpoint and listener. |
| SCGI | scgi_pass |
SCGI endpoint and port. |
| Memcached | memcached_pass |
Memcached listener rather than an HTTP server port. |
After correcting the loaded configuration, run sudo nginx -t and reload only after it succeeds:
sudo nginx -t
sudo systemctl reload nginxA reload applies the corrected configuration without unnecessarily dropping existing worker processes. If the direct socket test still fails, return to the backend listener and network checks; a valid configuration cannot make a closed port accept connections.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Topology-specific choices
| Topology | Preferred upstream address | Common mistake | Verification location |
|---|---|---|---|
| Nginx and application on one host | The application’s actual listening address and port; loopback is acceptable when both processes share the host. | Nginx points to an old port or the application binds a different interface. | Run ss -tlnp and a TCP test on that host. |
| Nginx and application on different hosts | The backend host’s private or routable address and service port. | Backend listens only on loopback or firewall rules omit the Nginx source. | Run the TCP test from the Nginx host. |
| Docker or Compose | Compose service name and container port on a shared network. | Using localhost or a host-published port from a sibling container. |
Run DNS and TCP tests inside the Nginx container. |
| Kubernetes | Service DNS name and Service port with ready endpoints. | Pointing at pod loopback, wrong Service port, or a selector with no ready endpoints. | Run tests from the Nginx pod and inspect Service endpoints. |
TCP proxying and connection-timeout details
For TCP load balancing, Nginx uses a named upstream group. Each server entry must include its port:
stream {
upstream database_pool {
server db-a.internal:5432;
server db-b.internal:5432;
}
server {
listen 15432;
proxy_pass database_pool;
proxy_connect_timeout 5s;
}
}The proxy_connect_timeout setting controls how long Nginx waits while establishing the upstream connection; it does not make a refused port healthy. If an upstream accepts traffic only from a particular source interface, proxy_bind can select the required local address. Confirm the chosen source is routed and permitted by the backend policy before using it.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Upstream groups, passive health, and retries
Nginx upstream groups use named peers and round-robin selection by default. Passive health behavior can mark a peer after repeated failures, and a request may be retried on another peer when the configuration and failure conditions allow it. With one upstream server, there is no alternate peer, so a refused connection generally reaches the client as a 502 immediately.
Multiple peers can therefore hide one failed backend temporarily. Treat that as resilience, not a repair: inspect the failing member, restore its listener, and verify it directly. Otherwise capacity shrinks silently and the remaining peers can fail under load.
Useful configuration and recovery checklist
- Copy the exact
upstream:destination from the error log. - Confirm the loaded destination with
nginx -T. - Run
nginx -tafter every configuration edit. - Use
ss -tlnpon the backend host or namespace to identify the owning process, port, and interface. - Run
nc -zvor an equivalent TCP check from the Nginx network namespace. - Use a service name and shared network for Docker or Kubernetes instead of container-local
localhost. - Test IPv4 and IPv6 explicitly whenever
localhostis involved. - Check firewalls, security groups, ACLs, and network policies for the actual Nginx source address.
- Investigate crashes and out-of-memory kills before adding retries.
- Reload Nginx only after syntax validation, then watch the error log and repeat the direct socket test.
Further reading
NGINX Cookbook, 2nd Edition by Derek DeJonghe was published by O’Reilly Media in May 2022 and runs to 202 pages. Its coverage includes installation, HTTP, TCP and UDP load balancing, passive health checks, and debugging and troubleshooting techniques.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
