Fix: RabbitMQ Connection Refused Error

The Error

You try to connect to RabbitMQ from your application and get:

AMQPConnectionError: Connection refused (111)

Or in Python with Pika:

pika.exceptions.AMQPConnectionError: Connection to 127.0.0.1:5672 failed

Or in Node.js with amqplib:

Error: connect ECONNREFUSED 127.0.0.1:5672

The application can’t establish a TCP connection to the RabbitMQ server.

Why This Happens

RabbitMQ listens on port 5672 for AMQP connections and port 15672 for the management UI. Connection refused means nothing is accepting connections on that port — either the service isn’t running, it’s bound to a different interface, a firewall is blocking the port, or credentials/vhost settings are rejecting the connection after it’s established.

Fix 1: Verify the Service Is Running

Check if RabbitMQ is actually running:

# Linux (systemd)
sudo systemctl status rabbitmq-server

# Check if the process exists
ps aux | grep rabbitmq

# Check if the port is open
ss -tlnp | grep 5672

If it’s not running, start it:

sudo systemctl start rabbitmq-server
sudo systemctl enable rabbitmq-server

Check the RabbitMQ logs for startup errors:

sudo tail -50 /var/log/rabbitmq/[email protected]

Common startup failures include Erlang cookie mismatches, port conflicts, and insufficient file descriptor limits.

Pro Tip: RabbitMQ depends on the Erlang runtime. If you upgraded Erlang separately, version incompatibility can prevent RabbitMQ from starting. Check compatibility at the RabbitMQ Erlang version requirements page.

Fix 2: Fix Port Configuration

RabbitMQ uses multiple ports:

A common mistake is connecting to 15672 (the management HTTP API) instead of 5672 (the AMQP protocol port):

# Wrong - management UI port
connection = pika.BlockingConnection(
    pika.ConnectionParameters(host='localhost', port=15672)
)

# Correct - AMQP port
connection = pika.BlockingConnection(
    pika.ConnectionParameters(host='localhost', port=5672)
)

Verify which port RabbitMQ is listening on:

sudo rabbitmqctl status | grep -A5 "Listeners"

Fix 3: Fix Credentials

RabbitMQ ships with a default guest user, but since version 3.3.0, the guest user can only connect from localhost:

# This fails from a remote machine
credentials = pika.PlainCredentials('guest', 'guest')
connection = pika.BlockingConnection(
    pika.ConnectionParameters(host='remote-server', credentials=credentials)
)

Create a new user for remote connections:

# Create user
sudo rabbitmqctl add_user myapp mypassword

# Set permissions
sudo rabbitmqctl set_permissions -p / myapp ".*" ".*" ".*"

# Optionally grant admin tag for management UI
sudo rabbitmqctl set_user_tags myapp administrator

Then connect with the new credentials:

credentials = pika.PlainCredentials('myapp', 'mypassword')
connection = pika.BlockingConnection(
    pika.ConnectionParameters(host='remote-server', credentials=credentials)
)

Common Mistake: If you override the guest user restrictions with loopback_users = none in rabbitmq.conf, you’re exposing a well-known default credential to the network. Always create dedicated users instead.

Fix 4: Fix Virtual Host Permissions

RabbitMQ uses virtual hosts (vhosts) to isolate environments. Users must have permissions on the vhost they’re connecting to:

# List vhosts
sudo rabbitmqctl list_vhosts

# Check user permissions
sudo rabbitmqctl list_user_permissions myapp

If the user lacks permissions on the target vhost:

# Create a vhost
sudo rabbitmqctl add_vhost my-app-vhost

# Grant permissions
sudo rabbitmqctl set_permissions -p my-app-vhost myapp ".*" ".*" ".*"

In your connection string, specify the vhost:

connection = pika.BlockingConnection(
    pika.ConnectionParameters(
        host='localhost',
        virtual_host='my-app-vhost',
        credentials=pika.PlainCredentials('myapp', 'mypassword')
    )
)

The three ".*" patterns in set_permissions control configure, write, and read access. ".*" grants full access. Restrict in production:

# Only allow access to queues starting with "myapp."
sudo rabbitmqctl set_permissions -p my-app-vhost myapp "^myapp\..*" "^myapp\..*" "^myapp\..*"

Fix 5: Fix Firewall Rules

If RabbitMQ is on a remote server, the firewall must allow traffic on port 5672:

# UFW (Ubuntu)
sudo ufw allow 5672/tcp
sudo ufw allow 15672/tcp

# firewalld (CentOS/RHEL)
sudo firewall-cmd --permanent --add-port=5672/tcp
sudo firewall-cmd --permanent --add-port=15672/tcp
sudo firewall-cmd --reload

# iptables
sudo iptables -A INPUT -p tcp --dport 5672 -j ACCEPT

For cloud providers, also check security groups:

• AWS: Edit the security group’s inbound rules for the EC2 instance
• GCP: Create a firewall rule allowing TCP 5672
• Azure: Add an inbound port rule in the network security group

Verify external access from the client machine:

telnet rabbitmq-server 5672
# or
nc -zv rabbitmq-server 5672

Fix 6: Fix Docker Networking

Running RabbitMQ in Docker has specific networking considerations:

# Wrong - container only accessible from inside Docker
docker run -d rabbitmq

# Correct - expose port to host
docker run -d -p 5672:5672 -p 15672:15672 rabbitmq:management

For Docker Compose, services connect using the service name as hostname, not localhost:

services:
  rabbitmq:
    image: rabbitmq:management
    ports:
      - "5672:5672"
      - "15672:15672"
  app:
    build: .
    depends_on:
      - rabbitmq
    environment:
      - RABBITMQ_HOST=rabbitmq  # Not localhost!

From inside the app container, connect to rabbitmq:5672. From the host machine, connect to localhost:5672.

If the application starts before RabbitMQ is ready, add a health check and wait:

services:
  rabbitmq:
    image: rabbitmq:management
    healthcheck:
      test: rabbitmq-diagnostics -q ping
      interval: 10s
      timeout: 5s
      retries: 5
  app:
    depends_on:
      rabbitmq:
        condition: service_healthy

Fix 7: Configure TLS/SSL Connections

If RabbitMQ is configured for TLS-only connections, plain AMQP on port 5672 won’t work:

# rabbitmq.conf
listeners.tcp = none
listeners.ssl.default = 5671
ssl_options.cacertfile = /etc/rabbitmq/ca_certificate.pem
ssl_options.certfile = /etc/rabbitmq/server_certificate.pem
ssl_options.keyfile = /etc/rabbitmq/server_key.pem

Connect using AMQPS (port 5671):

import ssl

context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
context.verify_mode = ssl.CERT_REQUIRED
context.load_verify_locations('/path/to/ca_certificate.pem')

ssl_options = pika.SSLOptions(context, 'rabbitmq-server')
connection = pika.BlockingConnection(
    pika.ConnectionParameters(
        host='rabbitmq-server',
        port=5671,
        ssl_options=ssl_options,
        credentials=pika.PlainCredentials('myapp', 'mypassword')
    )
)

Verify TLS is working:

openssl s_client -connect rabbitmq-server:5671

Fix 8: Fix Connection Limits

RabbitMQ may refuse new connections if limits are reached:

# Check current connections
sudo rabbitmqctl list_connections name state | wc -l

# Check file descriptor limits
sudo rabbitmqctl status | grep -A3 "File Descriptors"

Increase file descriptor limits in /etc/systemd/system/rabbitmq-server.service.d/limits.conf:

[Service]
LimitNOFILE=65536

Then reload:

sudo systemctl daemon-reload
sudo systemctl restart rabbitmq-server

Also check for connection leaks in your application. Each connection and channel should be properly closed:

try:
    connection = pika.BlockingConnection(params)
    channel = connection.channel()
    # ... use channel
finally:
    connection.close()

Still Not Working?

• Check the Erlang cookie. Nodes in a cluster must share the same cookie at /var/lib/rabbitmq/.erlang.cookie. A mismatch prevents inter-node communication.

• Verify DNS resolution. If using hostnames, ensure they resolve correctly from both the client and server.

• Check for memory alarms. RabbitMQ blocks connections when memory exceeds the threshold. Run sudo rabbitmqctl status | grep alarms to check.

• Test with the management API. If the management plugin is enabled, curl -u guest:guest http://localhost:15672/api/overview shows cluster status without needing an AMQP client.

• Look for port conflicts. Another service might be using port 5672. Check with ss -tlnp | grep 5672.

• Review the connection string format. AMQP URLs follow the format amqp://user:pass@host:port/vhost. The vhost must be URL-encoded if it contains special characters.