Free tools Windows power users keep installed
One-click scans. No signup required.
An SSH tunnel can look healthy while its forwarding path is dead. The ssh process may still appear in a process list even though a listener failed to bind, the encrypted session stopped responding, a firewall is dropping traffic, or the destination service is unavailable. Diagnose those as separate failures: verify the forwarding sockets, test the application path, add SSH-level liveness checks, and use autossh or a service manager when the tunnel must recover without a person at the keyboard.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an SSH tunnel actually is
An SSH tunnel is a long-lived SSH/TCP connection that carries one or more forwarded connections. SSH authentication can succeed and the encrypted session can remain established while the useful path through that session is broken. A process listing therefore answers only one question: whether a client process still exists. It does not prove that a local listener is accepting connections, that a reverse listener was created, or that the final service can be reached.
As an Amazon Associate I earn from qualifying purchases.
Keep the layers separate when troubleshooting:
- SSH session: Can the client authenticate and exchange encrypted traffic with the SSH server?
- Forwarding socket: Did the requested local, remote, or dynamic listener bind successfully?
- Network path: Can packets travel from the forwarding endpoint to the destination host and port?
- Application: Is the destination service running and speaking the protocol your client expects?
A keepalive can detect an unresponsive SSH peer. It cannot open a blocked firewall port, renew an expired credential, fix a wrong hostname, or start a database that is down.
Forwarding modes and where they fail
| Mode | What it creates | Typical failure to verify |
|---|---|---|
-L local forwarding |
A listener on the SSH client that sends connections through the server to a destination. | The local port is already occupied, the destination cannot be reached from the server, or the local bind address is not what the application uses. |
-R remote forwarding |
A listener on the SSH server that sends connections through the SSH client to a destination. | The remote listener is restricted to loopback, server policy rejects the bind, or the client-side destination is unavailable. |
-D dynamic forwarding |
A SOCKS proxy on the client; each application connection chooses a destination through it. | The proxy listener is missing, the application is not configured to use SOCKS, or the chosen destination is blocked. |
For remote listening sockets, OpenSSH documents loopback as the default bind scope. A reverse tunnel can therefore be functioning while clients on other machines cannot connect because the listener is reachable only from the SSH server itself.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Diagnose the tunnel in the foreground first
Remove backgrounding and wrappers until you know exactly which layer fails. If you do not need a remote shell, use -N; it tells SSH to establish forwarding without running a remote command.
- Run with maximum useful verbosity. Start the same forwarding command with
ssh -vvv -Nand your forwarding options. Watch for successful authentication, channel-open messages, and a confirmation that each requested listen socket was created. - Make forwarding errors fatal. Add
-o ExitOnForwardFailure=yes. A bind collision, insufficient permission, or rejected forwarding request should then terminate SSH instead of leaving a misleading process running. - Check the local listener. On Linux and many Unix systems, run
ss -ltnpand confirm the expected address and port belong to the SSH process. Use the platform’s equivalent socket-listing command wheressis unavailable. - Check a reverse listener on the remote host. Log in to the SSH server and run its socket-listing command. Confirm the address and port match the bind you requested. A listener on
127.0.0.1is intentionally inaccessible from other hosts. - Test the destination independently. From the machine that should be able to reach the destination, use a protocol-aware client for the service. For a database, use its database client; for an HTTP service, use an HTTP client; for another protocol, use its native health or handshake command. A successful TCP connect alone does not prove that the application is healthy.
- Separate infrastructure causes. Check DNS resolution, host-key and authentication errors, firewall policy, routing tables, and the destination service status as distinct items. Do not change keepalive settings to compensate for a blocked port or an expired key.
How to read the verbose output
Authentication lines show that the SSH server accepted your identity, not that forwarding is usable. For each -L, -R, or -D request, look for the corresponding listen or channel-open result. An explicit bind error identifies a local conflict or permission issue. A server refusal points to SSH forwarding policy or a remote bind restriction. If setup succeeds but later connections fail, move on to routing, firewall, and application checks; the tunnel may be alive while the destination path is not.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchKeepalive settings: choose the right mechanism
OpenSSH has two different families of keepalive behavior. They operate at different layers and have different failure characteristics.
| Option | Layer and behavior | What it can tell you | Important limitation |
|---|---|---|---|
ServerAliveInterval |
Encrypted SSH protocol message sent by the client after the specified idle interval. | Whether the SSH server is responding through the encrypted channel. | It does not test the ultimate forwarded service. |
ServerAliveCountMax |
Maximum number of unanswered server-alive probes before SSH disconnects. | Bounds how long an unresponsive session can remain before a restart mechanism can act. | The total delay depends on interval, count, and network timing. |
TCPKeepAlive |
TCP-level keepalive behavior supplied by the operating system. | Can help detect a dead TCP peer using kernel timers. | OpenSSH documents it as slower and spoofable compared with encrypted-channel server-alive messages. |
The OpenSSH configuration manual gives a concrete example: with ServerAliveInterval 15 and the default ServerAliveCountMax of 3, an unresponsive server causes SSH to disconnect after approximately 45 seconds. That is a detection example, not a universal guarantee; network delays and implementation details can change the observed time.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Set a deliberate liveness policy
Choose an interval shorter than the idle timeout imposed by the networks between your endpoints, but not so short that every transient delay causes needless reconnects. Then choose a count that matches the detection delay your application can tolerate. The commonly documented 15-second interval and count of 3 provide a clear starting point for an intermittent tunnel, with approximately 45 seconds before SSH gives up on an unresponsive peer.
Keepalive traffic is not encryption, authorization, or an application health check. It merely causes SSH to notice that the peer is no longer responding and, when paired with a supervisor, creates an opportunity to restart.
Make setup failures visible with ExitOnForwardFailure
Without ExitOnForwardFailure=yes, SSH can establish authentication and leave a session running even when one requested forwarding socket failed to bind or listen. That behavior is especially dangerous for scripts and service managers: they may see a live process and assume the tunnel is ready.
The option changes the failure signal. If a requested forward cannot be established, SSH exits, allowing an operator or supervisor to report the problem and try again. It checks establishment of the forwarding socket; it does not prove that future connections through that socket will reach the ultimate destination.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
A durable plain-OpenSSH tunnel
For a local database-style forward, a forwarding-only command can look like this:
ssh -N -o ServerAliveInterval=15 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -L 127.0.0.1:15432:db.internal:5432 user@bastionEach part has a distinct job:
-Navoids starting a remote shell or command.-o ServerAliveInterval=15sends an encrypted-channel liveness probe after 15 seconds of inactivity.-o ServerAliveCountMax=3limits unanswered probes before SSH disconnects.-o ExitOnForwardFailure=yesturns a failed bind or listen into a process failure.-L 127.0.0.1:15432:db.internal:5432listens only on the client loopback address and forwards local port 15432 throughbastiontodb.internalport 5432.user@bastionidentifies the SSH account and gateway; protect the private key used for unattended access.
Binding the local side to 127.0.0.1 limits exposure to applications on the tunnel host. Use a non-loopback bind only when other machines genuinely need access, and then review firewall rules and authorization deliberately.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use autossh when the SSH process must recover
autossh starts an SSH process, monitors it, and restarts it when SSH dies or stops passing traffic. A common pattern that relies on SSH protocol keepalives is:
autossh -M 0 -N -o ServerAliveInterval=15 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -L 127.0.0.1:15432:db.internal:5432 user@bastion-M 0 disables autossh’s separate monitor port. In this pattern, the server-alive options cause SSH to exit when the peer is unresponsive; autossh then sees the exit and starts a new copy. ExitOnForwardFailure=yes is important because the autossh manual recommends it: a forwarding setup error must not be mistaken for a healthy, idle session.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Autossh prerequisites and failure modes
- Unattended authentication: The restart loop cannot help if every launch waits for a passphrase, keyboard confirmation, or an interactive host-key prompt. Arrange secure key access and verify host keys before making the process unattended.
- Startup failures: A wrong destination, occupied local port, rejected remote bind, or missing permission can make every attempt fail immediately. Keep
ExitOnForwardFailure=yesenabled and inspect the original SSH error. - Not an application monitor: Autossh can restart when SSH dies or monitoring detects that traffic has stopped; it does not validate a database login, HTTP response, or other application-specific health condition.
- Backoff and logs: Prevent a rapid restart storm with the controls provided by your process supervisor, and retain SSH’s stderr so the reason for each exit is visible.
Put important tunnels under a service manager
For a boot-time or production tunnel, run SSH or autossh under the operating system’s service manager—such as systemd, launchd, supervisord, or the platform equivalent. The manager should provide a restart policy, dependency ordering, and persistent logs.
Design the service around the real prerequisites:
- Start only after networking is available and DNS can resolve the SSH host and destination names.
- Ensure the key file and its containing directory have the required ownership and permissions before launch.
- Keep the exact SSH command, including
-N, keepalive values, andExitOnForwardFailure=yes, in the service definition so manual and automated behavior match. - Use restart limits or backoff so an invalid configuration does not create an endless tight loop.
- Capture both SSH and supervisor logs, including the initial exit reason, bind error, authentication failure, or name-resolution problem.
There is no single mandatory supervisor configuration. The operational goal is to preserve the failure signal that OpenSSH and autossh provide, then apply a controlled restart policy.
Why SSH connects but the service behind the tunnel does not
The listener is bound to the wrong address
A local forward bound to loopback is reachable only on the tunnel client. A remote forward commonly binds to loopback on the SSH server by default. If a different machine must connect, the bind address, SSH server policy, and firewall must all permit that exposure. Expanding the bind scope increases attack surface; do it only with an explicit access-control plan.
The destination is reachable from the wrong endpoint
With -L, the SSH server side makes the connection to the destination. Test db.internal:5432, or the equivalent destination, from the bastion—not merely from your laptop. With -R, the SSH client side reaches the destination, so test from that machine. A destination that works locally may be unroutable from the endpoint that actually opens the forwarded connection.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Firewall and routing policy intervene
Security groups, host firewalls, network ACLs, and routes can allow the SSH control connection while blocking the forwarded destination port. Check policies in both directions and verify that the destination host has a return route. Keepalive probes traverse the SSH connection; they do not bypass these controls.
The application is down or expects a different protocol
A listening TCP port can still reject protocol handshakes, require TLS, demand authentication, or be backed by a stopped service. Use the service’s own client or health check through the tunnel. If the protocol-aware test fails while the listener exists, investigate the application and its credentials rather than reconnecting SSH repeatedly.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Symptom-to-cause troubleshooting table
| Symptom | Likely layer | Next check |
|---|---|---|
| SSH exits immediately with a bind error | Forwarding setup | Find the process occupying the port, change the local port, correct permissions, or fix the requested bind; keep ExitOnForwardFailure=yes enabled. |
| SSH stays running but no local port is listening | Forwarding setup or wrong command | Run ssh -vvv -N, inspect each forward result, and confirm the command actually contains the intended -L or -D option. |
| Reverse tunnel works on the server but not from another host | Bind scope or firewall | Inspect the remote listener address and SSH server forwarding policy; loopback listeners are not remotely reachable. |
| Port accepts connections, but the application times out | Routing, firewall, or destination service | Test the destination from the endpoint that initiates the forwarded connection and inspect firewall and route rules. |
| Tunnel dies after an idle period | Idle timeout or dead network path | Set a deliberate ServerAliveInterval/ServerAliveCountMax policy and use autossh or a service manager if automatic recovery is required. |
| Autossh restarts continuously | Persistent startup or authentication failure | Run the underlying SSH command in the foreground, read its verbose error, and fix keys, host keys, DNS, binds, policy, or destination reachability before tuning restart behavior. |
Security and correctness checklist
- Protect private keys and make unattended authentication intentional.
- Verify host keys; never disable host-key verification as a quick fix.
- Bind local listeners to loopback unless remote clients truly need access.
- Restrict forwarding destinations and review SSH server forwarding policy.
- Remember that keepalives detect liveness; they do not grant authorization or add encryption beyond the SSH session.
- Use
ExitOnForwardFailure=yesso a failed listener cannot masquerade as a healthy tunnel. - Test the actual application path after every change.
- Preserve logs from the foreground SSH process, autossh, and the service manager.
The reliable pattern is layered: prove each forwarding socket exists, prove the destination service is reachable from the correct endpoint, configure SSH to detect an unresponsive peer, and let a controlled supervisor restart only when a real failure signal occurs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
