Running a sample hello world web app on Debian GNU/Linux 13 (Trixie)

Your netstat output identifies the immediate problem: Kestrel is listening only on loopback, so requests from another PC cannot reach it. Allowing port 5111 through a firewall does not change the interfaces on which the application listens. The successful local request shows that the application can serve content locally.

For a controlled test, configure Kestrel with ListenAnyIP(5111) in the application’s endpoint configuration, restart it, and verify that the listener is no longer limited to loopback. Restrict test access to the required client and check any hosting-provider firewall as well as the host firewall. Test the TCP connection again before investigating DNS.

For production, Microsoft’s Linux hosting guidance uses a reverse proxy such as Nginx with HTTPS, while Kestrel can remain on loopback. Use a published application managed as a service rather than leaving dotnet run under root as the deployment model.