Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesExitOnForwardFailure=yes confirms that OpenSSH could set up the requested port forwarding; it does not confirm that the database can be reached through it. The actual connection to the forwarding destination happens only when an application uses the tunnel. OpenSSH’s manual states that the option “does not apply to connections made over port forwardings.” OpenSSH manual
What the option checks—and what it does not
When you request a local forward, SSH tries to create a listening port on your client. ExitOnForwardFailure=yes makes the SSH client exit if it cannot establish the requested forwarding setup—for example, if it cannot bind that local port. It does not make the SSH server connect to the database in advance or check whether that connection will succeed.
As an Amazon Associate I earn from qualifying purchases.
These are separate events: first SSH sets up the forward; later, an application connects to the local port, and the SSH server attempts to connect to the configured destination. A listener can therefore be active even when the database host or port is unreachable from the SSH server. OpenSSH manual PostgreSQL documentation
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhere the database connection actually comes from
For a local forward, the destination hostname is reached from the remote SSH side—not from the computer running your database client. That distinction matters when the destination is localhost: it means the SSH server’s loopback interface. If the database runs on that same machine and listens on loopback, this can be the right destination. If the database is a separate machine, use a destination address the SSH server can reach.
For example, PostgreSQL documents this tunnel:
ssh -L 63333:localhost:5432 [email protected]Here, the SSH server at foo.com is asked to connect to its own localhost:5432 when a client uses local port 63333. The command sets up the forward; it does not itself attempt a PostgreSQL connection. The database client does that:
psql -h localhost -p 63333 postgresUse the actual SSH host, destination hostname and port, and database settings for your environment. PostgreSQL documentation
Diagnose the failure by layer
Check the point where the connection stops rather than treating a successful SSH command as proof that every later step works.
- SSH connection: Confirm that the client establishes an SSH session with the intended server. A failure here is separate from forwarding or database access.
- Forward setup: Confirm the requested local port can be bound and the forward is created. This is the setup stage that
ExitOnForwardFailure=yeshelps detect. - Destination reachability: Connect a database client to the local forwarded endpoint. This causes the SSH server to attempt the destination connection. If that fails, check whether the SSH server can reach the specified host and port, and whether the address points to the intended machine.
- Database protocol and authentication: If the client reaches the database but reports a database-level error, investigate the database settings, user credentials, and server configuration. Successful forward setup alone says nothing about whether a database user can authenticate.
Check the destination address and network leg
Database on the SSH server
If the database is on the SSH server, localhost in the forward destination refers to that server’s loopback interface. A database listening only on loopback may not accept connections addressed to the server’s external hostname; those addresses are not interchangeable.
Rank #3
Database on a separate host
If the database is on another machine, the SSH server must be able to reach that machine and port. The SSH tunnel encrypts traffic between your client and the SSH server. The separate connection from the SSH server to the database host is not encrypted by that tunnel, as PostgreSQL’s guidance notes. PostgreSQL documentation
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a successful test establishes
Using a database client against the local forwarded port tests more than SSH setup: it exercises the tunnel, the SSH server’s connection to the destination, and the database interaction attempted by that client. Interpret the result according to the reported failure. A successful SSH setup is evidence only that the requested forwarding setup succeeded—not that the destination TCP connection, database service, or authentication will succeed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
