refused versus timed out (RST versus silence)

The two ways a TCP handshake fails, and they do not accuse the same suspects. Connection refused is an RST the destination's kernel built and sent back because no socket matched the port: it arrives in one round trip, 23 ms across the internet, and it proves your packet was delivered to a live machine. So "refused, the firewall is blocking me" is exactly backwards: a filter that blocks drops the SYN, and dropping produces silence. Your kernel then re-sends it six times — net.ipv4.tcp_syn_retries — and reports Connection timed out a little over two minutes later. A refusal sends you onto the machine, to ss -ltn. Silence sends you between the machines: the address, the route, then the filter.