Unless your NameNode is down, the only other reason, minus firewalls/etc.
misconfigs, is that the NameNode port (and maybe other services' ports) are
listening on a different network interfaces than the internal IP one. You
could verify this with netstat on the refusing service's host.