[j-nsp] Difference between "refused" and "not permitted"

[John Neiberger]

When I telnet from a Juniper router to a device on one TCP port I get
"connection refused", but if I try some other ports I get "operation
not permitted". What is the difference between these messages? Is it
that one is failing with no response at all from the far side while
the other is failing with an ICMP port unreachable or administratively
denied message?