VPS ping works but TCP port is unreachable: a diagnosis checklist

Why a successful ping is insufficient

ICMP echo shows that the tested address answered ICMP at one moment. It says little about TCP port 22, an HTTPS listener, TLS certificates or application health. Keep those measurements separate.

1. Diagnose a port you control

Replace YOUR_VPS_IP with your authorized VPS. Use a consistent port, time budget, and several rounds; check the address family and endpoint before testing.

pathtrial diagnose --scenario vps YOUR_VPS_IP --port 22
pathtrial scan YOUR_VPS_IP --profile ssh --rounds 5 --redact-ips

2. Distinguish refusal from timeout

A successful TCP connection only confirms that a connection was accepted during that attempt. A refusal means the endpoint or path returned a refusal/reset; it does not identify the device or rule involved. A timeout means no TCP connection succeeded before the deadline. None of these outcomes alone proves an ISP, firewall or provider caused the failure.

3. Check HTTPS separately

pathtrial diagnose --scenario web example.com
pathtrial http https://example.com/ --format json

Use an authorized hostname in place of example.com. TLS negotiation can fail after TCP succeeds. An HTTP 403 or 502 is an application response and should not be labeled a TCP connectivity failure. When using an IP address directly, pay attention to SNI and Host header behavior.

4. Inspect the server side

On a VPS you administer, verify the service is listening on the expected address and port, inspect service logs and ingress policy, and compare from another authorized network when possible. Two-ended collection can correlate endpoint records without claiming an exact packet-loss hop.

5. Share only reviewed evidence

pathtrial diagnose --scenario vps YOUR_VPS_IP --port 22 --format json --redact-ips

Capture the tested endpoint, port, rounds, timeout and timestamps, with true probe IDs. Before sharing, review the report: IP redaction does not automatically scrub every domain, local path or secret. SKIP and INCONCLUSIVE are not successes.