Modbus TCP Connection Refused: 7 Causes and How to Fix Them
Connection refused is the most common Modbus TCP failure and the most misleading. It sounds like a network problem, gets escalated to the network team, who find nothing wrong, because half the time the cause is a config value on the device. Here are the seven causes we see, ordered by how often they turn out to be the actual fault, plus a bisection method that finds it in minutes.
1. The device is not listening on port 502
Modbus TCP's well-known port is 502, but plenty of devices default to a vendor port (503, 5020, 20000) or expose Modbus on a secondary interface only. A refused connection on 502 with nothing listening is the device politely telling you the port is closed. Fix: confirm the configured Modbus TCP port in the device web UI or manual, and test that exact port.
2. A firewall is rejecting (or silently dropping) you
Firewalls live in three places: on the device, on your client, and on every router between them. A REJECT rule gives instant connection refused; a DROP rule gives a silent timeout instead. VLAN and zone policies on industrial firewalls frequently allow the PLC network out but not in. Fix: test from both sides of each hop, or temporarily allow TCP 502 end-to-end and re-test.
3. Wrong IP, or right IP, wrong interface
Devices get DHCP addresses that change; engineering laptops have Wi-Fi and Ethernet, and responses leave through the wrong interface. If you can ping the device but Modbus refuses, check which source interface your client uses. Fix: static IPs or DHCP reservations for devices, and an explicit route or interface binding on multi-homed clients.
4. The device hit its connection limit
Embedded Modbus servers accept a small, fixed number of TCP connections, often 4 to 10. Every stuck socket (a crashed client that never closed) consumes one. When the table is full, new connections are refused. Fix: power-cycle the device to clear stale sockets, shorten client timeouts, and reduce polling clients.
5. NAT, port forwarding, or VPN traps
Remote access through NAT works until the forward rule maps to the wrong internal port, or the VPN client routes your Modbus traffic into a tunnel that the device's return traffic never finds. Fix: test from inside the same network first. If it works locally and fails remotely, the fault is in the NAT/VPN layer, not Modbus.
6. Modbus TCP vs Modbus TLS (and the 502/802 confusion)
Modbus/TLS typically uses port 802. Pointing a plain Modbus TCP client at a TLS listener produces a refused or reset connection, because the handshake never speaks plain Modbus. Fix: confirm whether the endpoint expects plaintext 502 or TLS 802 and match your client.
7. The server function is simply disabled
Many gateways and drives ship with the Modbus TCP server off by default, or it turns off when the device is in programming mode. Nothing listens; everything is refused. Fix: enable the Modbus TCP server in the device configuration and re-test.
Refused vs timeout vs exception: know which one you have
| Symptom | Layer | Usual cause |
|---|---|---|
| Connection refused (instant) | TCP | Nothing listening, REJECT firewall, connection limit |
| Timeout (silent) | TCP / Modbus | DROP firewall, wrong unit ID, busy device, NAT return path |
| Exception code 0x0B (gateway target failed) | Modbus | Gateway cannot reach the serial-side device |
| Garbage register values | Application | Wrong byte order (word swap) or wrong data type |
Diagnose Modbus from Your Desktop
MacTools Modbus Poll for macOS: TCP + RTU master and slave simulator with a readable traffic view. Point it at any device and watch the actual bytes. $19 one-time.
Get Modbus Poll: $19Frequently Asked Questions
What port does Modbus TCP use?
Standard Modbus TCP uses TCP port 502. Some devices and gateways also expose a secondary port (503 and 2000-series ports are common on certain vendors). Always confirm the configured port in the device web UI or manual. Connection refused on 502 often just means the device listens on a different port.
What is the difference between connection refused and a Modbus timeout?
Connection refused means the TCP handshake itself failed: nothing accepted your connection on that IP and port, and the device (or a firewall) sent a TCP RST. A timeout means the TCP connection was established but no Modbus response arrived. The failure is one layer higher: wrong unit ID, the device is busy, or a gateway is filtering requests.
Can a firewall cause Modbus connection refused?
Yes, the most common cause in the field. A REJECT rule produces an instant connection refused; a DROP rule produces a silent timeout instead. Check firewalls on the device itself, on your client, and on any router or VLAN between them.
Why does Modbus work on my laptop but not from the PLC network?
Your laptop and the device are probably on different subnets or VLANs, with a router that allows one direction only. Machines with multiple network adapters (common on engineering laptops) also send responses out the wrong interface. Test from the same network segment the PLC uses, or add explicit routes.
How do I test a Modbus TCP device without a PLC?
Run a Modbus TCP slave simulator on a laptop, connect the device (or the PLC) to the same LAN, and point the device at the laptop's IP. If the device can write to your simulator, the device side is fine and the fault is in your original client configuration.
When the network is fine but monitoring is the job:
Voltrus SCADA polls Modbus plus OPC-UA, S7, EtherNet/IP and BACnet around the clock with dashboards, alarms, and history. Lifetime license from $49.