An application server can ping the database server by host name, and the DBA confirms the database service is running and accepts local connections on the server itself. Connections from the application server to TCP port 5432, however, hang and then time out without any error message from the database. What is the most likely cause?

A connection that hangs and times out, while ICMP to the same host succeeds and the service accepts local connections, points to a packet filter between the client and the listening port. Firewalls configured to drop rather than reject traffic produce exactly this signature: the TCP handshake never completes, so the client waits until its connect timeout expires. Host-based firewalls on the database server and network firewalls or security groups along the path are both candidates. Name resolution failure is ruled out because the host name already resolves well enough for ping to succeed. An expired password is an authentication problem; authentication happens only after a TCP session is established, and the database would return an explicit login failure rather than a silent timeout. Reaching the maximum connection limit also produces an explicit error from the engine, because the server accepts the TCP session and then refuses the database session with a message. Exam caveat: a listener bound only to localhost can look similar, but the scenario points to traffic being filtered on its way in. Operational check: test the port from the application server with a TCP connection utility, review host and network firewall rules for the database port, add a narrowly scoped allow rule for the application subnet, and retest.