Diagnose a failed session by layer

Start with the exact symptom. “Telnet does not work” hides several different failures, and each one lives at a different layer.

The client output usually tells you which layer failed, if you read it carefully:

telnet: could not resolve badname.lab.test: Name or service not known
telnet: Unable to connect to remote host: Connection refused
telnet: Unable to connect to remote host: Operation timed out

If the name does not resolve, inspect DNS. The connection never started, so firewalls and servers are not suspects yet. Test with dig or try the raw IP address instead.

If the connection is refused, the host answered but nothing listens on that port. Inspect the address, the port number, and the listening process on the server side:

ss -tlnp | grep 2323

If the connection times out, packets are disappearing. Inspect the route, the firewall, and the address. A refusal is an answer; a timeout is silence. They point at different problems.

After the connection succeeds

If bytes arrive but look strange, inspect Telnet negotiation and terminal settings. A connected session with duplicated or invisible input usually points to echo negotiation. Broken screen layout may point to terminal type or window size.

A login rejection belongs to authentication or account policy. The network did its job: your connection worked, your credentials or account did not. Do not restart the network stack for a wrong password.

An application that accepts the connection and then misbehaves is yet another layer. The service may speak a different protocol than you expected, or be unhealthy behind a working port.

Work methodically

Change one layer at a time. If you change the port, the firewall rule, and the server config in one step, a fixed session teaches you nothing about which change mattered.

Preserve the client message, server log, and a byte trace when negotiation is involved. Evidence is more useful than repeatedly changing ports or disabling checks. My advice is to write down each test and its result as you go. Five minutes of notes beats an hour of re-testing things you already ruled out.