SSH forwarding lets you tunnel traffic through an SSH connection, but when it fails, you might see errors like:

bash
$ ssh -L 8080:localhost:80 user@server
channel 0: open failed: administratively prohibited: open failed

Or for agent forwarding:

bash
$ ssh -A user@server
Warning: agent forwarding requested, but agent not running

Or X11 forwarding:

bash
$ ssh -X user@server
X11 forwarding request failed on channel 0

Let's diagnose and fix each forwarding type.

Port Forwarding (Local)

Local port forwarding creates a tunnel from your machine to a remote destination:

bash
ssh -L local_port:remote_host:remote_port user@server

Diagnose Local Forwarding Failure

Run with verbose output:

bash
ssh -vv -L 8080:localhost:80 user@server

Look for:

bash
debug1: Local connections to LOCALHOST:8080 forwarded to remote address localhost:80
debug1: channel 0: new [port-forward]
debug1: channel 0: open failed: administratively prohibited

Check GatewayPorts Setting

By default, SSH only binds forwarded ports to localhost. If you need external access:

bash
ssh -L 8080:localhost:80 -o GatewayPorts=yes user@server

Or on the server side, check if AllowTcpForwarding is enabled:

bash
sudo grep AllowTcpForwarding /etc/ssh/sshd_config

Should be:

bash
AllowTcpForwarding yes

If it's set to no:

bash
sudo sed -i 's/^AllowTcpForwarding.*/AllowTcpForwarding yes/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Verify Port Binding

Check if the port is actually bound:

bash
netstat -tlnp | grep 8080

Should show:

bash
tcp        0      0 127.0.0.1:8080    0.0.0.0:*     LISTEN      12345/ssh

If nothing is bound, the forwarding failed to start.

Check Firewall on Local Machine

Local firewall might block the forwarded port:

bash
sudo iptables -L INPUT -n | grep 8080

Allow the port:

bash
sudo iptables -I INPUT -p tcp --dport 8080 -j ACCEPT

Remote Port Forwarding

Remote forwarding (-R) binds a port on the server that tunnels back to your machine:

bash
ssh -R 9000:localhost:3000 user@server

Diagnose Remote Forwarding Failure

Check if GatewayPorts is needed on the server:

bash
ssh -R 9000:localhost:3000 -o GatewayPorts=yes user@server

The server needs to allow binding to non-localhost addresses:

bash
# On server's sshd_config
GatewayPorts clientspecified

Check Server Firewall

The remote port must be accessible on the server:

bash
# On server
sudo iptables -L INPUT -n | grep 9000

Allow it:

bash
sudo iptables -I INPUT -p tcp --dport 9000 -j ACCEPT

Dynamic Port Forwarding (SOCKS Proxy)

Create a SOCKS proxy:

bash
ssh -D 1080 user@server

Test the proxy:

bash
curl --socks5 localhost:1080 http://example.com

Fix SOCKS Forwarding Issues

If it fails, check:

bash
ssh -vv -D 1080 user@server 2>&1 | grep "channel"

Verify the port is bound:

bash
netstat -tlnp | grep 1080

Agent Forwarding

Agent forwarding lets you use your local SSH keys on a remote server:

bash
ssh -A user@server

Check if Agent is Running Locally

bash
ssh-add -l

Should list your keys. If it fails:

bash
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_rsa

Check Server PermitOpen

The server might restrict forwarding destinations:

bash
sudo grep PermitOpen /etc/ssh/sshd_config

If set to specific hosts:

bash
PermitOpen localhost:80 localhost:443

You can only forward to those destinations. To allow all:

bash
sudo sed -i 's/^PermitOpen.*/PermitOpen any/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Check AllowAgentForwarding

On the server:

bash
sudo grep AllowAgentForwarding /etc/ssh/sshd_config

Should be:

bash
AllowAgentForwarding yes

If missing or no:

bash
echo "AllowAgentForwarding yes" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

Verify Agent Forwarding Works

On the remote server after connecting with -A:

bash
echo $SSH_AUTH_SOCK

Should show a socket path like:

bash
/tmp/ssh-XXXXXXXX/agent.12345

Test by SSH-ing to another host from the server:

bash
ssh user@another-server

This should use your forwarded agent credentials.

X11 Forwarding

Forward GUI applications:

bash
ssh -X user@server

Or with trusted mode (less secure):

bash
ssh -Y user@server

Check X11Forwarding Setting

On the server:

bash
sudo grep X11Forwarding /etc/ssh/sshd_config

Should be:

bash
X11Forwarding yes

Enable it:

bash
sudo sed -i 's/^X11Forwarding.*/X11Forwarding yes/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Check xauth Installation

X11 forwarding requires xauth:

bash
# On server
which xauth

Install if missing:

bash
sudo apt install xauth  # Debian/Ubuntu
sudo yum install xauth  # RHEL/CentOS

Verify DISPLAY Variable

On the remote server after connecting:

bash
echo $DISPLAY

Should show something like:

bash
localhost:10.0

Test with a simple X program:

bash
xclock

Multiple Forwardings

You can chain multiple forwardings:

bash
ssh -L 8080:localhost:80 -L 3306:db-server:3306 -D 1080 user@server

Debug Multiple Forwardings

Check each forwarding individually:

bash
ssh -vv -L 8080:localhost:80 user@server 2>&1 | grep "channel 0"
ssh -vv -L 3306:db-server:3306 user@server 2>&1 | grep "channel 1"

Forwarding Through Jump Host

Forward through a bastion/jump host:

bash
ssh -L 8080:internal-server:80 -J jumphost user@jumphost

Or using ProxyJump:

bash
ssh -L 8080:internal-server:80 -o ProxyJump=jumphost user@internal-server

Check Jump Host Forwarding

The jump host must allow port forwarding:

bash
# On jump host
sudo grep AllowTcpForwarding /etc/ssh/sshd_config

Connection Timeout Issues

Forwarded connections might timeout if the destination is unreachable:

bash
ssh -L 8080:unreachable-server:80 user@server

Test connectivity from the server:

bash
# On server
curl -v http://unreachable-server:80
nc -zv unreachable-server 80

Port Already in Use

If the local port is taken:

bash
bind: Address already in use
channel_setup_fwd_listener_tcpip: cannot listen to port: 8080

Check what's using the port:

bash
sudo lsof -i :8080
sudo netstat -tlnp | grep 8080

Choose a different port:

bash
ssh -L 8081:localhost:80 user@server

Resolution Checklist

  1. 1.Check AllowTcpForwarding yes on server
  2. 2.Check AllowAgentForwarding yes for agent forwarding
  3. 3.Check X11Forwarding yes for X11 forwarding
  4. 4.Use GatewayPorts=yes for external access
  5. 5.Verify port isn't blocked by firewall
  6. 6.Verify destination is reachable from server
  7. 7.Ensure agent is running locally (ssh-add -l)
  8. 8.Install xauth for X11 forwarding

Forwarding issues are usually server-side configuration restrictions. Start by checking the sshd_config settings for the specific forwarding type you're trying to use.