The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →SSH database tunnels usually fail in one of two places: the SSH server refuses to create the forwarding channel, or it creates the channel but cannot reach the database. “administratively prohibited” is a server-policy decision; “connect failed” or “connection refused” means the requested database endpoint is unreachable from the SSH server. Identify which message you have before changing settings.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Identify the failure before changing anything
Run the tunnel in the foreground with verbose logging so you can see whether the failure occurs while opening the SSH forwarding channel or after the channel has been accepted:
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchssh -vvv -N -L 15432:db.internal.example:5432 [email protected]The local port and database details in that command are examples. Replace them with your own values. The important log patterns are distinct.
“channel 0: open failed: administratively prohibited: open failed”
This message, including variants such as “channel 2: open failed: administratively prohibited”, means the SSH server rejected the request to open a TCP-forwarding channel. The request did not get as far as a database connection. The usual causes are AllowTcpForwarding, PermitOpen, DisableForwarding, or a more specific Match rule that applies to your account, group, source address, or connection path.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
“ssh -L connect failed” or “connection refused” through an SSH tunnel
Messages such as channel 0: open failed: connect failed: Connection refused indicate that the SSH server permitted the forwarding channel and then tried to connect to the destination. The destination host rejected the TCP connection, was not listening on that port, or was unreachable because of routing or firewall rules. Fix the database endpoint and network path rather than changing forwarding permission directives.
| Observed message | What happened | Where to investigate |
|---|---|---|
administratively prohibited |
The SSH daemon refused the forwarding channel by policy. | AllowTcpForwarding, PermitOpen, DisableForwarding, and applicable Match blocks. |
connect failed |
The channel was allowed, but the SSH server could not establish the database-side TCP connection. | Database address, port, listener, route, host firewall, security groups, and network ACLs. |
connection refused |
The target host answered but no permitted service accepted the connection on that port, or a firewall actively rejected it. | Database service state, listen address, port, and firewall policy. |
| No error, but the client cannot connect locally | The local listener may not have started, may be bound to another address, or the local port may already be in use. | SSH startup output, local socket state, bind address, and client configuration. |
Confirm the ssh -L command and endpoint perspective
The general syntax is:
ssh -N -L [local_bind:]local_port:db_host:db_port user@ssh_host-Nrequests no remote shell; SSH is used only for forwarding.local_bindis optional. Omitting it normally binds the local listener to loopback, so applications on the same computer use127.0.0.1.local_portis the port your database client connects to on the laptop or workstation.db_hostanddb_portare the destination as seen from the SSH server, not from the laptop.user@ssh_hostis the SSH account and host that receives the forwarding request.
Remember that localhost means the SSH server
In -L 15432:localhost:5432, localhost refers to the machine running sshd. It does not refer to your laptop. Use it only when the database is listening on the SSH host itself. If the database is on another server, use the address reachable from the SSH host, such as db01.internal or its private IP address.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
With a jump host or bastion, verify which machine is the final SSH endpoint and which machine can resolve and reach db_host. A hostname that resolves on your laptop may not resolve in the bastion’s DNS domain. Testing the destination by IP can separate DNS failure from TCP or policy failure, but use the correct private address for the network where the SSH server resides.
Rule out a local bind problem
If SSH cannot bind the local port, it normally reports a local forwarding or address-in-use error rather than an administrative channel refusal. Check whether another process owns the port:
ss -ltnp | grep ':15432'Choose an unused local port, for example 25432, and connect your database client to that port:
ssh -N -o ExitOnForwardFailure=yes -L 25432:db.internal.example:5432 [email protected]ExitOnForwardFailure=yes makes the SSH client terminate if it cannot establish the requested listener, which prevents an application from silently trying a nonexistent tunnel.
Fix “administratively prohibited” on the SSH server
These checks require administrator access to the SSH host or help from whoever manages it. Inspect the configuration actually used for your session; a permissive global setting can be overridden later.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
1. Set AllowTcpForwarding for a local forward
OpenSSH documents these values: yes (the default), all, no, local, and remote. A local -L forward requires yes, all, or local. Values no and remote block it.
In the appropriate server configuration, a typical setting is:
AllowTcpForwarding localUse yes or all only when the account is also intended to create remote forwards. Least privilege usually favors local for a user who needs only database access through -L. Do not assume that adding the directive at the top of the file is sufficient; a later rule can change the effective value.
2. Check PermitOpen destination restrictions
PermitOpen limits the destinations to which TCP forwarding may connect. With no explicit restriction, all destinations are permitted. An explicit list can contain host-and-port pairs, IPv4-address-and-port pairs, or bracketed IPv6-and-port pairs, for example:
PermitOpen db.internal.example:5432
PermitOpen 10.20.4.15:5432
PermitOpen [2001:db8:10::15]:5432The requested db_host:db_port must match an allowed entry. A typo, a different DNS name for the same server, or an unlisted port can therefore produce administratively prohibited even when AllowTcpForwarding is enabled. The special value any removes the destination restriction; use it only when unrestricted forwarding is acceptable.
3. Look for DisableForwarding
DisableForwarding yes disables TCP forwarding along with X11, agent, and StreamLocal forwarding. It overrides the other forwarding options, so changing AllowTcpForwarding or PermitOpen will not restore a tunnel while this setting is active.
OpenSSH behavior is version-sensitive. In versions before 10.0, the directive did not fully match its documentation because X11 and agent forwarding were not disabled as expected (CVE-2025-32728). That historical discrepancy does not make DisableForwarding a valid way around a TCP-forwarding restriction; check the man page for the version installed on your server and treat the directive as an overriding prohibition.
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
4. Inspect every applicable Match block
OpenSSH evaluates conditional Match sections for attributes such as user, group, and source address. A rule for your account can override the global value, and a bastion may apply a different rule than another SSH host. Search the complete configuration, including files included from the main configuration, and determine the effective values for the exact login you are using.
A common reason that “AllowTcpForwarding yes” appears not to work is that a later Match User, Match Group, or source-address rule sets AllowTcpForwarding no, sets it to remote, adds a restrictive PermitOpen, or enables DisableForwarding.
5. Validate and reload safely
Check syntax before asking the daemon to reload:
sudo sshd -tThen inspect the daemon’s effective, expanded settings:
sudo sshd -T | grep -i -e allowtcpforwarding -e permitopen -e disableforwardingThe exact output can vary with OpenSSH version and conditional configuration. Confirm that it represents the user and source address you are troubleshooting; some installations require additional options to evaluate a particular Match context.
Free tools Windows power users keep installed
One-click scans. No signup required.
After a successful syntax check, reload the service using the name used by your operating system, commonly:
sudo systemctl reload sshdOn systems whose unit is named ssh, use sudo systemctl reload ssh instead. Keep an existing administrative session open while testing a new one so a configuration mistake does not lock you out.
Settings that do not fix a local -L failure
GatewayPorts is for remote forwards
GatewayPorts controls how remote forwards created with -R bind on the server. Its default behavior keeps a remote-forward listener on loopback unless another policy allows a non-loopback address. It does not decide whether a local -L request is permitted, so changing it will not clear administratively prohibited for a local tunnel.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
PermitTunnel is for tun(4) devices
PermitTunnel controls VPN-style tun(4) device forwarding and defaults to no. A TCP local forward is not a tun device and does not require this option. Some older guides suggest enabling it for every tunnel error, but the OpenSSH directive definition does not support that advice for -L. Changing AllowTcpForwarding resolved a reported ProxyJump forwarding problem where changing PermitTunnel was irrelevant.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsFix “connect failed” and “connection refused” after forwarding is allowed
Once policy permits the channel, troubleshoot from the SSH server toward the database. Your laptop’s ability to resolve or reach the database address is not proof that the bastion can do so.
Verify the database listener and port
- Confirm the database service is running on the expected host.
- Confirm the service is listening on the requested port, not only on a different port.
- Check whether it listens on the server’s private interface rather than only on
127.0.0.1or only on IPv6. - Make sure the tunnel uses the database’s actual TCP port; a database client port and an SSH port are independent.
On the database host, an administrator can inspect listening sockets with the operating system’s socket tools. A listener bound only to loopback accepts connections from that same machine, while a listener bound to a private address accepts connections arriving over the internal network interface.
Test DNS and TCP reachability from the SSH host
Run tests on the SSH server, not just on the laptop:
getent hosts db.internal.example
nc -vz db.internal.example 5432If DNS lookup fails, use the correct resolvable name or an approved IP address and fix the bastion’s DNS configuration. If lookup succeeds but nc reports refusal, inspect the database listener and host firewall. If it times out, inspect routing, security groups, network ACLs, and intermediate firewalls. A successful TCP test proves reachability only; it does not authenticate a database session.
Check firewall and network policy in the entire path
The path is laptop to SSH server, then SSH server to database. The second leg may cross a cloud security group, a container network, a host firewall, or a private subnet boundary. Permit the SSH server’s source IP or subnet to reach the database port, not the laptop’s public IP. If the database runs in a container, verify that the name resolves in the SSH host’s network namespace and that the container port is published or reachable on the container network.
Separate network failure from database authentication
After the tunnel is established, your database client connects to the local listener, for example 127.0.0.1:15432. Database credentials, TLS mode, certificate names, and user permissions are then handled by the database server. An authentication or TLS error means the TCP tunnel is working; do not continue changing SSH forwarding directives for a database-login problem.
Use verbose SSH output to locate the exact stage
Increase verbosity with -vvv and watch for these stages:
- Local listener creation: lines indicating that SSH is listening on the requested local address and port. If this never appears, investigate local binding or client syntax.
- Forwarding channel request: SSH sends the destination host and port to the server. An immediate
administratively prohibitedresponse points to server policy. - Destination connection: the server attempts the database-side TCP connection.
connect failed,Connection refused, or a timeout points to the endpoint and network path. - Application protocol: once TCP succeeds, the database client negotiates authentication or TLS. Errors at this stage belong to database configuration.
The channel number in the message, such as channel 0 or channel 2, is an internal SSH channel identifier. It does not identify a firewall rule, database port, or particular server.
A repeatable repair procedure
- Capture the exact command and error. Run the command with
-vvvand record whether the message containsadministratively prohibited,connect failed, orconnection refused. - Check the local side. Confirm the local port is unused, use
ExitOnForwardFailure=yes, and connect the database client to the same local address and port that SSH opened. - Confirm endpoint meaning. Replace an incorrect
localhostwith the database address reachable from the SSH host. Verify the name and port from the bastion’s perspective. - For an administrative refusal, inspect policy. Evaluate
AllowTcpForwarding,PermitOpen,DisableForwarding, and all matching conditional rules. - Validate the server configuration. Run
sudo sshd -t, inspect effective values withsudo sshd -T, and reload the correct service unit. - For a connection failure, test from the SSH host. Resolve the database name and test its TCP port with an appropriate connectivity tool.
- Correct the database-side cause. Fix the listener address or port, route, firewall, security group, ACL, container network, or DNS issue identified by the test.
- Retest with the real client. Once the tunnel opens and the server can reach the endpoint, address any remaining database credentials or TLS errors as a separate layer.
Common scenarios and their correct interpretation
“AllowTcpForwarding not working”
First confirm the setting is effective for the session rather than merely present in the global file. A Match block, an included configuration file, PermitOpen, or DisableForwarding can still deny the request. Use the daemon’s expanded configuration and test with a new SSH connection after reloading.
The tunnel works to one database but not another
This pattern often indicates PermitOpen restrictions or different network reachability. Compare the exact destination hostname and port in each -L command. An allowed IP address may not match a separately listed DNS name, and a second database may be on a subnet the bastion cannot reach.
A hostname fails but an IP address works
The SSH server resolves db_host for the forwarding connection. Different DNS search domains, split-horizon DNS, stale records, or IPv4-versus-IPv6 selection can make a name fail even when the service is reachable by address. Use the address only if it is stable and permitted by your network policy; otherwise correct DNS and keep the hostname.
A ProxyJump connection reaches the wrong network
With a jump host, the forwarding request must ultimately be handled by an SSH endpoint that can resolve and route to the database. Confirm the target SSH host, the jump configuration, and the destination as seen from that host. Verbose logs help establish which connection is opening the forwarding channel.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Security considerations when enabling forwarding
Forwarding is a capability, not merely a convenience. Broadly enabling it can let an account reach internal services that are otherwise inaccessible. Prefer AllowTcpForwarding local for users who need only local tunnels, and restrict destinations with PermitOpen host:port where practical. Grant only the database destinations required for the task, review changes to conditional rules, and remove temporary exceptions after maintenance.
Do not expose a local listener on all interfaces unless another device genuinely needs to use the tunnel. A command that binds 0.0.0.0:15432 can make the forwarded database reachable from other machines on the local network. The default loopback binding is safer for a tunnel used only by applications on your workstation.
When to involve the SSH or database administrator
Provide the administrator with the exact SSH command (redacting secrets), the full -vvv error, the SSH client and server versions, the effective forwarding settings, and the result of the reachability test from the SSH host. This information distinguishes a policy refusal from a database-side network problem without asking for unrestricted forwarding or unnecessary firewall changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
