Modbus TCP Connection Refused / Can't Connect

You're trying to connect to a Modbus TCP device and the connection is immediately refused, times out at the TCP level, or connects but gets no Modbus responses. This guide covers the systematic approach to diagnosing TCP-level connection issues.

Connection Refused vs Timeout

Connection refused (immediate rejection) means something is actively rejecting your TCP SYN packet. A firewall, the device itself, or the wrong port. Connection timeout (slow failure) means your packets aren't reaching the device at all — a routing, VLAN, or physical network problem.

Network Layer Checks

1. Ping the device

If you can't ping it, Modbus TCP won't work. Check IP address, subnet mask, gateway. Ensure you're on the same subnet or that routing is configured.

2. Check VLAN configuration

In SCADA environments, Modbus devices are often on a separate VLAN from the engineering workstation. Verify the switch port configuration and VLAN tagging.

3. Check for duplicate IPs

If two devices share the same IP, the ARP table flips between their MAC addresses and connections fail intermittently. Use arp -a to check for multiple MACs on the same IP.

Port & Firewall Issues

Modbus TCP defaults to port 502. Some devices use non-standard ports. Some firewalls block port 502 by default. Test with: telnet [device-ip] 502 — if it connects (even briefly), the TCP path is clear.

On Windows, the built-in firewall may block outbound connections to port 502. Check Windows Defender Firewall rules if you're testing from a laptop.

Maximum Connection Limits

Many Modbus TCP devices only support 2-5 simultaneous TCP connections. Common culprits:

• Your SCADA system holds a permanent connection
• A commissioning tool from last week is still connected (and the device never timed it out)
• Another engineer's laptop has Modbus Poll open

Solution: Power-cycle the device to clear all connections, or check the device's web interface (many have one) to see and kill active connections.

Unit ID Confusion

Even after TCP connects, you need the right Unit ID in the Modbus TCP header. Standalone devices usually expect Unit ID 1 or 255. Modbus TCP gateways (that bridge to RS485 devices behind them) need the actual slave address of the target device as the Unit ID. Getting this wrong results in timeouts or exception responses.