Dial tcp 127.0.0.1:8500: getsockopt: connection refused in consul

Question

I am getting this error when I am running any "consul members" on consul server and clients. The port is in LISTENING state and I made sure there is no firewall blocking. I get this error when in run the same in the consul client:

Error retrieving members: Get http://127.0.0.1:8500/v1/agent/members:
dial tcp 127.0.0.1:8500: connectex: No connection could be made because the target machine actively refused it.

When I make the above request with the private IP, I get the required output. Can I change the configuration anywhere so that it listens on the private IP for requests?

Answer 1

It seems that your consul members lacks the option -http-addr=....

Example

consul members -http-addr=10.10.10.10:8500

while assuming you use the standard port 8500 of the consul agent and that you started consul via:

consul agent -client=10.10.10.10 #...

Where to find the documentation?

• In the Consul Documentation under Running an Agent: "Client Addr":

  If you change this address or port, you'll have to specify a -http-addr whenever you run commands such as consul members to indicate how to reach the agent.

• Or offline via consul members -help:

  http-addr=<address> Theaddressand port of the Consul HTTP agent. The value can be an IP address or DNS address, but it must also include the port. This can also be specified via the CONSUL_HTTP_ADDR environment variable. The default value is http://127.0.0.1:8500. The scheme can also be set to HTTPS by setting the environment variable CONSUL_HTTP_SSL=true.

Answer 2

You may also get this when the Consul agent has failed to start. If you are running it using systemctl, check the logs (e.g. /var/log/syslog) to see if there is an error. In my case I had the wrong permissions on my certificate files.