Free tools Windows power users keep installed
One-click scans. No signup required.
When two VPS servers cannot communicate, identify the exact source address, destination address, protocol, and port before changing anything. Then test the path in order: provider network and routes, cloud firewall rules, the TCP handshake, the destination listener, the guest firewall, DNS and address family, and finally the application protocol. A timeout, a refusal, and a successful handshake each point to a different fault.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start with a precise traffic definition
Write down one attempted connection in a form that another administrator could reproduce:
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Source: VPS name, zone or region, and the private and public addresses on the originating server.
- Destination: VPS name, zone or region, and the address that the client is actually using.
- Protocol: TCP or UDP, plus any higher-level protocol such as SSH, HTTPS, a database protocol, or a game-server protocol.
- Destination port: the listening port on the destination VPS, not the temporary client port.
- Expected path: same private network, peered networks, VPN, public internet, or a bastion/jump host.
Test one source and one destination first. Keeping the test narrow makes packet captures, firewall counters, and route changes easier to interpret. Do not begin by opening every port or permitting the whole internet; that can hide the real defect and create an unnecessary exposure.
Understand the layers that must agree
Communication succeeds only when every layer along the route permits it. A valid service configuration cannot compensate for a missing route, and a correct route cannot compensate for a provider firewall drop.
#1 Best Overall
- 40 Gbps 2000 Mhz High Speed: The Cat 8 ethernet cable support max. 40 Gbps data transfer and 2000 MHz Brandwith, ideal for gaming and streaming, greatly improving upload and download speed, sound, image and resolution quality
- Excellent Anti-interference: The ethernet cable comes with 4 shielded foiled twisted pairs (F/FTP), pure copper core and gold-plated RJ45 connector, reducing interference, noise and crosstalk, making network speed faster and more stable
- Marvelous Durability: Internet cable wrapped with quality cotton braided cord, which makes the LAN cable stronger and more durable. The test proves that this internet cable can be bent at least 10000 times without broken, very suitable for long-term use
- PoE Supported: All lengths of ethernet cord can support the PoE power supply function except 65ft. You don't need additional power supply when installing a PoE camera, which is very convenient and safe
- Wide Compatibility: With the RJ45 Connector, network cable can be perfectly compatible with computers, laptops, modems, routers, PS5, X-Box and other networking devices. It can also be fully backward compatible with Cat7, Cat6e, Cat6, Cat5e, Cat5
Provider network placement
For private addressing, both VPS instances need to be attached to the same VPC, VNet, or equivalent private network, or their networks must be explicitly connected through peering or a VPN. Confirm the attachment and region or zone restrictions in the provider console. A hostname that resolves to a public address may bypass the private design you intended.
Routes in both directions
Review the route table associated with the source subnet and the route table associated with the destination subnet. There must be a forward route for the destination CIDR and a return route for the source CIDR. A one-way route produces a classic timeout: the SYN reaches the destination, but the reply cannot return.
Recommended Free Tools
Peering is not a universal transit service. AWS documents that VPC peering does not provide edge-to-edge routing through gateways or private connections. It also does not automatically supply internet-gateway routing, VPN transit, or NAT between the two networks. If your design depends on one of those paths, configure it explicitly rather than assuming peering will carry it.
Provider firewalls and policy layers
Cloud firewalls, security groups, network ACLs, and organization-level policies are enforced outside the guest operating system. Google Cloud describes VPC firewall behavior as an implied ingress deny with egress allowed by default; on a non-default network, you must create an ingress allow rule for the traffic you need. Other providers use different defaults, so inspect the effective policy rather than relying on a remembered template.
Permit the narrowest combination of source private CIDR, protocol, and destination port. Check both ingress at the destination and egress at the source. A rule that allows SSH on port 22 does not allow an application on another port, even when both servers can log in to each other.
Rank #2
- Cat 6 performance at a Cat5e price but with higher bandwidth
- High Performance Cat6, 30 AWG, RJ45 Ethernet Patch Cable provides universal connectivity for LAN network components such as PCs,computer servers,printers,routers,switch boxes,network media players,NAS,VoIP phones
- Jadaol cat6 standard cable support Cat8 and Cat7 network and provides performance of up to 250 MHz 10Gbps and is suitable for 10BASE-T, 100BASE-TX (Fast Ethernet), 1000BASE-T/1000BASE-TX (Gigabit Ethernet) and 10GBASE-T (10-Gigabit Ethernet)
- UTP(Unshielded Twisted Pair) patch cable with RJ45 gold-plated Connectors and are made of 100% bare copper wire, ensure minimal noise and interference
- The unique flat cable shape allows for a cleaner and safer installation. You can easily and seamlessly make the cable run along walls, follow edges & corners or even make it completely invisible by sliding it under a carpet.
Test the TCP handshake from the source VPS
Run the test on the originating VPS, using the exact destination address and port the application uses. For a TCP service, a verbose probe can be run with:
curl -vso /dev/null --connect-timeout 5 DEST_IP:DEST_PORTAn equivalent check is:
nc -vz DEST_IP DEST_PORTThe five-second connect timeout limits how long a silent drop stalls the test; it is not a statement about the application’s normal request timeout. Repeat the same probe after each single-layer change so you can attribute an outcome to that change.
| Probe result | What it establishes | Most useful next checks |
|---|---|---|
| Connection succeeds | The path, operating-system filtering, and a listening server completed the TCP handshake. | Inspect application behavior, authentication, TLS, the requested resource, and whether the client is using the correct application port. |
| Connection times out | No response reached the source before the probe stopped waiting. | Check the address, both route directions, provider rules, guest-firewall drops, and asymmetric routing. |
| Connection is refused or reset | Packets reached the destination, but the destination, application, or a firewall actively rejected them. | Verify the listener, its bind address, service state, and rules that send rejects or resets. |
A successful handshake does not prove that an HTTP request, database login, game session, or other application exchange will work. It proves only that a TCP listener was reachable through the controls involved in that handshake.
Confirm the destination is listening correctly
Log in to the destination VPS through an existing management path and inspect listening sockets:
ss -lntupUse the service’s native status command as well. Confirm all of the following:
Rank #3
- Designed for Outdoor & Direct Burial Installations – Heavy-duty double-shielded Cat8 Ethernet cable minimizes EMI/RFI interference and delivers stable long-distance performance. Waterproof, anti-corrosion PVC jacket allows safe direct burial and reliable use in outdoor or indoor environments.
- 26AWG for Stable High-Load Networks – Thicker 26AWG conductors provide faster, more stable data transmission than standard 32AWG cables. Ideal for high-performance home networks, gaming setups, smart homes, and data-intensive applications.
- F/FTP Shielding & Hyper-Speed Performance: Cat8 Ethernet cable constructed with 4 shielded foiled twisted pairs and 26AWG OFC conductors; supports bandwidth up to 2000 MHz and data transmission speeds up to 40 Gbps, effectively reducing signal interference and ensuring stable connections. Ideal for low-latency gaming, 4K/8K streaming, and high-speed internet connections.
- RJ45 Connectors & Wide Compatibility: Cat8 Ethernet cable with two shielded RJ45 connectors; compatible with networking switches, IP cameras, routers, Nintendo Switch, modems, PS3, PS4, Xbox, patch panels, servers, smart TVs, and more; works with Cat7, Cat6, Cat5e, and Cat5 devices
- Weatherproof & UV Resistant: Outdoor-rated Cat8 Ethernet cable with UV-resistant PVC jacket; withstands direct sunlight, extreme cold, humidity, and hot weather; anti-aging and durable; Includes 18-month support.
- The daemon is running and has not crashed or failed during startup.
- The port number matches the client configuration exactly.
- The process is bound to the destination’s private address or to an appropriate wildcard address such as
0.0.0.0for IPv4 or::for IPv6. - The service is not bound only to
127.0.0.1or::1, which accepts connections only from the local machine. - The service is using the protocol you are testing. A UDP listener will not answer a TCP handshake on the same numeric port.
If the service listens on a specific private interface, verify that the interface is present and has the address you expect. A restart after a network reconfiguration can leave a daemon bound to an address that no longer exists.
Inspect guest firewalls on both VPSs
Provider rules and guest rules are separate. A cloud firewall can allow a packet that the Linux host then drops, or a guest rule can allow it while the provider silently filters it. Check the firewall actually installed on each server.
UFW
ufw statusLook for an allow rule that matches the source private CIDR, protocol, and destination port. A rule permitting SSH from a management subnet does not automatically permit the application subnet.
iptables
iptables -L -n -v -xThe verbose, exact counters are valuable evidence. A counter increasing on a matching DROP rule while you repeat the probe identifies the host as the rejecting layer. A source-restricted ACCEPT rule should match the intended private range and port before any broader drop rule.
Other firewall implementations
Use the equivalent status and rule-list command for the installed firewall framework. Inspect both input and output policy where egress filtering is enabled. Remember that a stateful firewall must also allow the return traffic for an established connection; a stateless ACL may require explicit rules in both directions.
Rank #4
- High-Performance Connectivity: This Cat 6 ethernet cable is designed for superior performance, with a 24 AWG copper wire core. It provides universal connectivity as an ethernet cord for LAN network components such as PCs, servers, printers, routers, and more, ensuring reliable and fast network connections
- Advanced Cat6 Technology: Experience Cat6 performance with higher bandwidth at a Cat5e price. This network cable is future-proof, ready for 10-Gigabit Ethernet and backwards compatible with any existing Cat 5 cable network. It meets or exceeds Category 6 performance according to the TIA/EIA 568-C.2 standard
- Reliable Wired Network Solution: Known variously as a Cat6 network cable, ethernet cable Cat 6, or Cat 6 data/LAN cable, this RJ45 cable offers a more secure and reliable connection than wireless networks. It's ideal for internet connections that demand consistency and security
- Durable and Secure Design: The connectors of this ethernet cable feature gold-plated contacts and strain-relief boots for enhanced durability. Bare copper conductors not only improve cable performance but also comply with communication cable specifications
- High-Speed Data Transfer: With up to 550 MHz bandwidth, this ethernet cord is ideal for server applications, cloud computing, video surveillance, and streaming high-definition video. It also supports Power over Ethernet (PoE, PoE+, PoE++) for powering devices like IP cameras, VoIP phones, and wireless access points, ensuring fast and reliable network performance.
Validate DNS and IPv4 versus IPv6
Resolve the service hostname from the source VPS and compare every returned address with the intended private address. AWS lists incorrect DNS resolution as a common cause of VPC-peering failures. A split-horizon DNS record may return a private address inside one network and a public address elsewhere.
When both address families are published, test them separately. An unreachable IPv6 path or stale AAAA record can make a client appear to fail even though IPv4 works. Force the client or diagnostic tool to use the address family you are investigating, then compare the result with the other family. Also check that the daemon is listening on that family; an IPv4-only listener will not accept an IPv6 connection.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInterpret the common “SSH works but the application times out” case
SSH success proves only that TCP port 22 is reachable through its own rules and listener. It says nothing about the application port. Compare the SSH and application paths layer by layer:
- Use the destination’s private address for both tests where possible.
- Run the same verbose TCP probe against the application port.
- Compare provider firewall rules for port 22 and the application port.
- Compare guest-firewall rules and counters for the same ports.
- Confirm the application is bound to the private interface rather than loopback.
- Check whether the application expects UDP while you are testing TCP.
If the application port completes its handshake, move above the network layer. Inspect application logs, credentials, authorization, protocol framing, and TLS settings. A client and server can connect at TCP level but fail because they require different TLS versions or encryption modes, because the client is using the wrong service port, or because the server rejects the requested identity.
Reach a private-only VPS through a bastion
A private-only VPS has no public network interface. DigitalOcean states that private Droplets cannot be reached directly from the internet. Place a bastion or jump host with a public address in the same VPC, or in a peered VPC with valid routes to the private server.
Best Value
- 40 Gbps 2000 Mhz High Speed: The Cat 8 ethernet cable support max. 40 Gbps data transfer and 2000 MHz Brandwith, ideal for gaming and streaming, greatly improving upload and download speed, sound, image and resolution quality
- Excellent Anti-interference: The ethernet cable comes with 4 shielded foiled twisted pairs (F/FTP), pure copper core and gold-plated RJ45 connector, reducing interference, noise and crosstalk, making network speed faster and more stable
- Marvelous Durability: Internet cable wrapped with quality cotton braided cord, which makes the LAN cable stronger and more durable. The test proves that this internet cable can be bent at least 10000 times without broken, very suitable for long-term use
- PoE Supported: All lengths of ethernet cord can support the PoE power supply function except 65ft. You don't need additional power supply when installing a PoE camera, which is very convenient and safe
- Wide Compatibility: With the RJ45 Connector, network cable can be perfectly compatible with computers, laptops, modems, routers, PS5, X-Box and other networking devices. It can also be fully backward compatible with Cat7, Cat6e, Cat6, Cat5e, Cat5
Required bastion design
- Allow SSH to the bastion only from your administration addresses.
- Allow SSH from the bastion’s private VPC address or CIDR to the private VPS.
- Ensure route tables contain a path from the bastion subnet to the private VPS and a return path.
- Keep the application traffic on private addresses; the bastion is an access point, not a reason to expose the application port publicly.
A NAT gateway provides outbound access for private instances but does not accept inbound SSH or other unsolicited connections. Do not try to use NAT as a replacement for a bastion or an inbound load-balancing design.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Investigate stalls, packet loss, and UDP behavior
When a TCP connection succeeds but transfers stall, or when UDP is intermittent, compare the MTU configured on each interface with the provider network’s MTU. Google Cloud notes that mismatched MTUs are generally less troublesome for TCP but can affect UDP. Large UDP datagrams may be discarded or fragmented, and some paths do not handle fragmentation reliably.
Check latency and packet loss with the provider’s reachability or performance tools before changing routes. Capture traffic only after you have narrowed the test to one source, one destination, and one port. Look for retransmitted SYNs, unanswered packets, or replies leaving through an unexpected interface. An asymmetric return path can produce a timeout even when the destination received the request.
Apply fixes safely
Use a controlled sequence rather than changing provider rules, routes, and the service configuration at once.
- Preserve an out-of-band path. Keep a provider console or serial-console session available before editing routes or firewall policy. Google cautions that an incorrect route can disconnect a VM.
- Correct the network placement. Attach both VPSs to the intended private network or configure the required peering or VPN.
- Add or repair routes. Install the destination CIDR route on the source side and the source CIDR return route on the destination side.
- Permit only required provider traffic. Match the source private CIDR, protocol, and destination port. Check security groups, network ACLs, and organization policies.
- Fix the listener. Start the service, correct its port, and bind it to the private interface or an appropriate wildcard address.
- Fix the guest firewall. Add the narrowest matching rule and verify its counters while repeating the probe.
- Retest the handshake. Use the same
curlornccommand and record the new result. - Resolve application-layer errors. Review logs, TLS or encryption requirements, authentication, and client-port settings only after TCP succeeds.
Use TLS/HTTPS or SSH forwarding for sensitive traffic. Google lists firewalls, HTTPS/TLS, SSH port forwarding, and SOCKS proxies as protection methods, while warning that a firewall alone does not protect credentials or data in transit.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsChoose the right connection architecture
| Architecture choice | When it fits | Important limitation or control |
|---|---|---|
| Private IPs on one VPC or VNet | Both VPSs belong to the same provider network and need internal service traffic. | Still requires correct routes and provider and guest firewall rules. |
| Peered private networks | Services are separated into different networks but need private addressing. | Peering does not automatically provide gateway transit, VPN transit, NAT, or internet-gateway routing. |
| VPN between networks | Traffic must cross otherwise separate private networks through an encrypted tunnel. | Both tunnel endpoints and both directional routes must be healthy. |
| Public IP connection | No private path exists and the service is intentionally internet-reachable. | Restrict source ranges and ports; public exposure increases scanning and attack surface. |
| Bastion or jump host | The destination is private-only and administrators need SSH access. | The bastion needs a public management path and private routing to the destination; NAT alone cannot accept inbound SSH. |
| TCP transport | The application requires ordered, reliable streams such as SSH or HTTPS. | A successful handshake does not validate application authentication or TLS. |
| UDP transport | The application depends on datagrams or low-latency delivery. | MTU mismatch, loss, and filtering can affect UDP even when TCP appears healthy. |
A compact incident checklist
- Have you recorded the exact source IP, destination IP, protocol, and destination port?
- Are both VPSs in the same private network, or is peering or VPN configured?
- Do route tables contain forward and return routes for both private CIDRs?
- Do provider firewalls, security groups, ACLs, and organization policies allow the traffic?
- Does a TCP probe succeed, time out, or reset?
- Is the destination service running and listening on the intended private interface and port?
- Do guest-firewall rules and packet counters match the expected source and port?
- Does DNS resolve to the intended private address, and have IPv4 and IPv6 been tested separately?
- If the VPS is private-only, is a correctly routed bastion available?
- If TCP works but the application fails, have logs, TLS, encryption, authentication, and client-port settings been checked?
- For UDP or stalled transfers, has MTU and packet loss been investigated?
What each outcome tells you
The diagnostic result is more valuable than a generic “network error.” A timeout directs attention to addressing, routes, silent drops, and asymmetric return paths. A refusal or reset confirms that traffic reached the destination but was actively rejected, so listener and reject rules deserve priority. A completed handshake moves the investigation above basic connectivity into service configuration, authentication, TLS, and protocol behavior. Following that order prevents you from weakening security controls or rewriting application code to solve a fault that actually belongs to a different layer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
