Skip to main content
protocols.pageprotocols.page
2

SSH_OPEN_CONNECT_FAILED

Channel FailureRFC 4254 §5.1

SSH_OPEN_CONNECT_FAILED (2) is sent when the server attempted to open the requested channel connection but the underlying TCP or socket connection failed. For direct-tcpip (port forwarding), this means the server could not connect to the forwarding destination host and port.

Code

2

Category

Channel Failure

Standard

RFC 4254 §5.1

Description

When a client requests a direct-tcpip channel for SSH port forwarding, the server must establish a TCP connection to the forwarding destination. If that TCP connection fails – connection refused, network unreachable, or timeout – the server sends SSH_MSG_CHANNEL_OPEN_FAILURE with code 2.

This code is the SSH-layer equivalent of TCP ECONNREFUSED or ETIMEDOUT for the forwarded connection. The SSH session itself remains open and functional. Only the specific channel open fails.

Common in SSH tunneling scenarios: the service being forwarded is down, the destination host is unreachable from the SSH server (not from the client), or the firewall between the SSH server and forwarding destination blocks the connection. This is a frequent source of confusion – the user assumes the destination is reachable because they can reach it locally, but SSH tunnels route through the server's network.

Common Causes

  • –Forwarding destination service is not running (connection refused)
  • –Forwarding destination host is unreachable from the SSH server's network
  • –Firewall between SSH server and forwarding destination blocking the connection
  • –Forwarding destination TCP connection timed out
  • –Unix socket specified in streamlocal forwarding does not exist
RFC 4254 – SSH specification →