I was wondering what would cause a firewall to block a TCP Java socket from connecting. What would trigger that?
There are two main types of firewalls. The first type is the network kind where it simply blocks a port in general. It does this by simply not allowing a connection on that port, typically unless an outgoing connection is made on the port first. The other is an application firewall which runs on a client and restricts which applications specifically can access the network or be accessed by the network.
A firewall is going to block a particular TCP port simply because that is how it is configured. There isn't anything that "triggers" it. It's just the behavior of the device to not allow connections that aren't configured.
If it is an intrusion detection system rather than a simple firewall, there could be traffic analysis done on the data being exchanged and if suspicious activity is detected, then it could be configured to start blocking the port, but that's a more rare situation. If this covers your situation, you'd have to talk to the people that configured the IDS rules to know what caused the blocking.