What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When an SSH tunnel to a database fails, the exact error determines the fix. “channel 0: open failed: administratively prohibited: open failed” and “channel 2: open failed: administratively prohibited” mean the SSH server refused the forwarding channel. An “ssh -L connect failed” or “connection refused” message usually means the channel was permitted, but the database host, port, listener, or firewall could not be reached.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide separates those failures, shows how to correct AllowTcpForwarding, PermitOpen, and DisableForwarding, and gives a repeatable way to verify the tunnel from both the SSH host and your computer.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →First identify which failure you have
Local forwarding has two independent stages. Your SSH client asks the SSH server to create a TCP channel, and that channel then connects from the SSH server to the database destination. A failure at the first stage is an SSH policy problem; a failure at the second is a network or database-endpoint problem.
“administratively prohibited” is an SSH policy refusal
Messages such as channel 0: open failed: administratively prohibited: open failed or channel 2: open failed: administratively prohibited are generated when the SSH daemon rejects the forwarding request. The channel number is not significant. The server has received the request but will not open it under the effective policy for that connection.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The usual controls are AllowTcpForwarding, PermitOpen, and DisableForwarding. A Match block can also apply a different value to your user, group, source address, or other connection attributes than the global part of sshd_config.
“connect failed” or “connection refused” means the destination could not be reached
If verbose output reports an SSH channel that was opened and then shows connect failed, Connection refused, or a timeout, forwarding permission has generally already been granted. The SSH host is attempting to connect to the database address and port, but no service is listening there, the address is wrong, or a firewall is rejecting or dropping the connection.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →In this case, changing AllowTcpForwarding or GatewayPorts will not repair the database path. Test the same destination from the SSH host itself.
Use a known-good tunnel command
Local forwarding syntax
The basic form is:
ssh -N -L [local_bind:]local_port:db_host:db_port user@ssh_host-Nrequests no remote shell or command; SSH stays open only for forwarding.local_bindis optional. If omitted, the client uses its local default binding. Use an explicit loopback address when the database should be reachable only from your computer.local_portis a free port on your computer, such as15432.db_hostanddb_portare the destination as seen fromssh_host, not from your laptop.user@ssh_hostidentifies the SSH account and host running the daemon that must be allowed to forward.
For example, a PostgreSQL client could use local port 15432 while the SSH server connects to db.internal on port 5432:
ssh -N -L 127.0.0.1:15432:db.internal:5432 [email protected]Your database client then connects to 127.0.0.1:15432. It does not connect directly to db.internal:5432.
The destination is resolved from the SSH server’s point of view
localhost in the destination portion means the SSH server itself. It does not mean the computer running the SSH command. Use localhost only when the database is on the SSH host or is exposed there through another local service. If the database is on a separate machine, use that machine’s private address or a hostname resolvable by the SSH host.
A hostname that resolves on your laptop may not resolve on the bastion. Conversely, a private hostname may resolve only inside the server’s network. To remove DNS ambiguity, temporarily use the database server’s IP address and test again. This is a diagnostic step, not a reason to ignore DNS configuration permanently.
Confirm that the intended SSH host is being used
Aliases, jump hosts, and automation can make a command reach a different daemon than expected. Run the command with -vvv:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
ssh -vvv -N -L 127.0.0.1:15432:db.internal:5432 [email protected]The debug stream shows authentication, the forwarding request, and the destination the client asked the server to open. Check the connected hostname, username, and port before changing server configuration.
Fix “administratively prohibited” on the SSH server
1. Set an appropriate AllowTcpForwarding value
OpenSSH documents these values:
| Value | Effect on ssh -L |
|---|---|
yes |
Allows TCP forwarding in both directions; this is the documented default. |
all |
Allows local and remote TCP forwarding. |
local |
Allows local forwards such as -L but not remote forwards. |
remote |
Allows remote forwards such as -R, not the local forward required here. |
no |
Disables TCP forwarding. |
Edit the server’s SSH configuration, commonly /etc/ssh/sshd_config, and set AllowTcpForwarding yes or AllowTcpForwarding local for a user that needs only -L. A value of remote or no blocks this use.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Do not assume that a line near the top of the file is the effective setting. A later Match section can apply a restrictive value to the account or source address that is actually connecting.
2. Check PermitOpen restrictions
PermitOpen limits where a permitted forward may connect. With no explicit restriction, forwarding destinations are allowed. If it is configured, each permitted destination must match the requested host and port. OpenSSH accepts entries in the forms host:port, IPv4_address:port, and [IPv6_address]:port. The special value any removes the destination restriction.
For a tunnel to a database, the entry must match the destination in the -L command, not the local listening address. For example, a policy allowing db.internal:5432 will not necessarily allow an equivalent IP address if the configuration lists only the hostname. Keep the rule as narrow as practical, but make it match the form the SSH request actually uses.
3. Look for DisableForwarding
DisableForwarding yes disables X11, agent, TCP, and Unix-domain socket forwarding and overrides the other forwarding options. If it is enabled for your session, changing AllowTcpForwarding or adding a PermitOpen entry will not make -L work. Remove or scope the disabling rule only when the account is intended to create a database tunnel.
OpenSSH versions before 10.0 had a documented-behavior mismatch in which DisableForwarding did not fully disable X11 and agent forwarding (CVE-2025-32728). That historical issue does not make TCP forwarding safe to assume: check the behavior and defaults of the version installed on the server.
4. Inspect every applicable Match block
OpenSSH can set forwarding policy by user, group, source address, or other connection attributes. A global AllowTcpForwarding yes can therefore coexist with a per-user AllowTcpForwarding no, a restricted PermitOpen, or DisableForwarding yes.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Review the complete file and any included configuration files for the account and network from which you connect. If a hosting provider or configuration-management system generates the file, make the change in that system so it is not overwritten.
5. Validate the effective configuration before reloading
First check syntax:
sudo sshd -tThen inspect the daemon’s effective forwarding values:
Recommended Free Tools
sudo sshd -T | grep -i -e allowtcpforwarding -e permitopen -e disableforwardingThe output should show a value that permits local forwarding and a permitopen policy that includes the requested destination. If the output does not reflect your edit, investigate an included file or a Match rule rather than repeatedly changing the same global line.
After syntax succeeds, reload the SSH service using the service manager for the operating system, for example:
sudo systemctl reload sshdKeep your existing SSH session open while testing. A syntax error or an unexpected policy can otherwise leave you locked out. Establish a new connection and repeat the tunnel command with -vvv.
Why GatewayPorts and PermitTunnel do not fix -L
GatewayPorts controls remote forwards
GatewayPorts governs remote forwarding created with -R, including whether a remote listening socket can bind beyond loopback. It does not decide whether the SSH daemon accepts a local -L request. Changing it will not clear an “administratively prohibited” error from local forwarding.
PermitTunnel is for tun(4) devices
PermitTunnel controls VPN-style layer-2 or layer-3 tun(4) device forwarding and is documented as disabled by default. A TCP port forward created with -L is a different mechanism. Enabling PermitTunnel is therefore not the required fix for a database tunnel. Reports that changing it solved a particular setup can reflect another simultaneous configuration change or a nonstandard environment.
Diagnose “ssh -L connect failed” and “connection refused”
Test the destination from the SSH host
Log in to the SSH host without the tunnel and test the database address and port from there. For a basic TCP check, use a tool available on that system, such as:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
nc -vz db.internal 5432Replace the hostname and port with the exact values in your -L command. If this test fails, the SSH daemon cannot reach the database endpoint either. Investigate the endpoint before changing SSH forwarding policy.
Verify the database is listening on the required interface
A database bound only to its own loopback address accepts connections from that machine but not from the SSH host when the database is on another server. Check the database listener address and port on the database machine. The service must listen on an address reachable from the SSH host, and the destination in the tunnel must point to that address.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIf the database and SSH daemon are on the same machine, db_host=localhost can be correct. If they are separate, use the database machine’s private network address or an internally resolvable hostname.
Check the port, protocol, and firewall path
A refused connection commonly means that nothing is listening on the selected port or that a host firewall actively rejected it. A timeout commonly indicates filtering or a routing problem. Check:
- the database’s configured listening port;
- the address family used by the hostname, especially when IPv4 and IPv6 records differ;
- firewall rules on the database host;
- network ACLs or security groups between the SSH host and database;
- whether the database service is running and healthy.
Make the test from the SSH host, not only from your laptop. The laptop may have access to a different network path and can produce a misleading result.
Use a harmless local port and test the client separately
A local port can already be occupied by another process. If SSH reports a local bind error such as Address already in use, choose another local port; this is a client-side bind problem, not an SSH server forwarding refusal.
Once SSH remains connected, point the database client at the local endpoint. For example, use host 127.0.0.1 and port 15432 if that is the local side of your tunnel. Keep the SSH process running while the client connects. Closing the SSH process closes the forwarding channel.
Jump hosts, bastions, and multi-hop tunnels
Understand which daemon creates the forward
With a jump configuration such as:
ssh -J gateway.example -N -L 127.0.0.1:15432:db.internal:5432 [email protected]the final SSH server is the daemon asked to open a connection to db.internal:5432. The gateway transports the SSH connection; it does not automatically grant forwarding permission on the final host. Check the effective forwarding policy on the server that receives the -L request.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
If you build separate nested tunnels, each SSH connection has its own policy and destination viewpoint. Verify the host, user, and destination at every hop. A hostname that resolves on the gateway may not resolve on the final SSH host.
Confirm the policy on the intended host
Use -vvv with the complete jump command and look for the server identity and forwarding request. If the request is refused immediately, inspect AllowTcpForwarding, PermitOpen, DisableForwarding, and applicable Match rules on that daemon. If the request succeeds but the destination connection fails, test the database path from that final host.
Common symptoms and the next action
| Symptom | What it indicates | Next action |
|---|---|---|
channel 0: open failed: administratively prohibited: open failed |
The SSH daemon rejected local forwarding. | Inspect effective AllowTcpForwarding, PermitOpen, DisableForwarding, and Match settings. |
channel 2: open failed: administratively prohibited |
The same policy refusal; the channel number is incidental. | Use the same server-policy checks and validate with sshd -T. |
connect failed after a channel-open message |
Forwarding was accepted, but the SSH host could not connect to the destination. | Test the exact database host and port from the SSH host. |
Connection refused |
The destination address was reached, but no acceptable service was listening or a firewall rejected the connection. | Check database service status, listener address, port, and firewall rules. |
Connection timed out |
Traffic is being dropped or a route is missing. | Check routing, ACLs, security groups, and host firewalls between the SSH host and database. |
bind: Address already in use |
Your computer cannot claim the selected local port. | Choose an unused local port or stop the process currently listening there. |
Operate the tunnel safely
Restrict destinations when possible
Allowing every forwarding destination is broader than a database-only tunnel requires. When policy permits, use PermitOpen to authorize only the database hostname and port needed by the application. This limits what the SSH account can reach if its credentials are compromised.
Bind the local listener to loopback
Use 127.0.0.1:local_port when only the local machine needs access. Do not bind to all interfaces unless other devices on the network genuinely need to use the tunnel and you have evaluated that exposure. A local forward can otherwise become an unintended proxy into the private database network.
Keep credentials and tunnel lifetime in mind
The database still authenticates the client after SSH has connected. SSH authentication and database authentication are separate controls. Use the database account intended for the application, close the SSH process when finished, and avoid leaving a privileged tunnel running unattended.
Check version-specific behavior
OpenSSH server behavior and defaults vary by release. In particular, the behavior of DisableForwarding differed before version 10.0. Confirm the installed version’s sshd_config(5) manual and inspect the effective configuration instead of relying on a copied example from another operating system.
Free tools Windows power users keep installed
One-click scans. No signup required.
A deterministic recovery sequence
- Copy the complete error and run the tunnel with
-vvv. - If the message says
administratively prohibited, inspect the SSH daemon policy before touching database settings. - Run
sudo sshd -t, then inspectsudo sshd -T | grep -i -e allowtcpforwarding -e permitopen -e disableforwarding. - Correct the applicable
AllowTcpForwarding,PermitOpen, orDisableForwardingrule, including anyMatchblock, and reload the daemon. - If the channel is accepted but reports
connect failed, log in to the SSH host and test the exact destination with a TCP client. - Correct the database listener address, port, route, or firewall, then retry the tunnel.
- Connect your database software to the local bind address and local port, not directly to the private destination.
The key decision is simple: an administrative refusal is enforced by SSH policy, while a connection refusal occurs after forwarding has been allowed. Keeping those stages separate prevents changes to unrelated settings and leads directly to the system that needs repair.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
