How to fix channel 1: open failed: connect failed: Connection refused in SSH

SSHINTERMEDIATEHIGHUpdated Jan 4, 2026· 239 views

This error occurs during SSH port forwarding (tunneling) when the target service is not running, listening on the wrong port, or blocked by a firewall. The SSH connection succeeds, but the forwarded connection to the remote service fails.

Quick fix

Fixes channel 1: open failed: connect failed: Connection refused

# Check if service is running (e.g., MySQL on port 3306)
ssh user@remote-host
netstat -tlnp | grep <port>
# or using ss
ss -tlnp | grep <port>

# Or check service status directly
sudo systemctl status mysql  # or your service name
sudo systemctl status postgresql
sudo systemctl status redis-server
  1. Verify the target service is running on the remote host
  2. Confirm the correct port number
  3. Test connectivity directly on the remote host
  4. Check firewall rules on the remote host
ssh — error
# Check if service is running (e.g., MySQL on port 3306)
ssh user@remote-host
netstat -tlnp | grep <port>
# or using ss
ss -tlnp | grep <port>
# Or check service status directly
sudo systemctl status mysql  # or your service name
sudo systemctl status postgresql
sudo systemctl status redis-server
channel 1: open failed: connect failed: Connection refused

What this error means

The "channel open failed: connect failed: Connection refused" error happens specifically during SSH port forwarding operations. Unlike a general SSH connection refused error, this occurs after your SSH connection to the server is established. The SSH client has successfully connected to the remote SSH server, but when it attempts to forward a connection to a service on the remote host (or through to another destination), that service is not accepting connections. This typically means the target service is not running, listening on a different port, or the firewall is blocking the connection.

Typical symptoms

  • SSH connection works fine, but tunneling commands fail with "connect failed" message
  • Local port forwarding (ssh -L) fails when trying to access the forwarded service
  • Remote port forwarding (ssh -R) fails to establish the reverse tunnel
  • Error appears immediately after SSH connection is established and tunnel is attempted
  • Works for SSH itself but fails for tunneled services like databases, web servers, or other applications

Common causes

  1. The target service is not running on the remote host (database daemon down, web server stopped, etc.)
  2. The service is listening on a different port than specified in the SSH forwarding command
  3. A firewall (iptables, firewalld, ufw) on the remote host is blocking connections to the target service port
  4. The service is bound only to localhost (127.0.0.1) and you are attempting to reach it from a different network interface
  5. Incorrect SSH tunnel syntax or misconfigured local/remote port mapping
  6. The remote host is blocking inter-interface communication (localhost only accessible locally)

How to fix "channel 1: open failed: connect failed: Connection refused"

1Verify the target service is running on the remote host

SSH into the remote server directly and check if the target service is active.

bash
# Check if service is running (e.g., MySQL on port 3306)
ssh user@remote-host
netstat -tlnp | grep <port>
# or using ss
ss -tlnp | grep <port>

# Or check service status directly
sudo systemctl status mysql  # or your service name
sudo systemctl status postgresql
sudo systemctl status redis-server

If the service is not running, start it:

bash
sudo systemctl start mysql
sudo systemctl start postgresql
2Confirm the correct port number

Verify that your SSH forwarding command uses the correct port where the service is listening.

bash
# Example: Forwarding MySQL (3306) from remote host
ssh -L 3306:localhost:3306 user@remote-host

# Example: Forwarding PostgreSQL (5432)
ssh -L 5432:localhost:5432 user@remote-host

# Example: Forwarding web server (8080)
ssh -L 8080:localhost:8080 user@remote-host

Verify the remote service is actually listening on that port:

bash
ssh user@remote-host
netstat -tlnp | grep LISTEN

Look for the port you're trying to forward and note which service is bound to it.

3Test connectivity directly on the remote host

From the remote host, test if you can reach the target service locally:

bash
ssh user@remote-host

# Test with curl (for HTTP services)
curl localhost:8080

# Test with nc (netcat) for any service
nc -zv localhost 3306

# Test with telnet
telnet localhost 3306

# Test with psql (PostgreSQL)
psql -h localhost -U postgres

If these commands fail on the remote host itself, the service is not running or not listening on that port.

4Check firewall rules on the remote host

The remote firewall might be blocking connections to the service port:

bash
# Check iptables rules
sudo iptables -L -n

# Check firewalld (RHEL/CentOS)
sudo firewall-cmd --list-all

# Check UFW (Ubuntu/Debian)
sudo ufw status

If the port is blocked, add a firewall rule to allow it (only for internal traffic if possible):

bash
# UFW example - allow MySQL from localhost
sudo ufw allow 3306/tcp

# iptables example
sudo iptables -A INPUT -p tcp -d 127.0.0.1 --dport 3306 -j ACCEPT

# firewalld example
sudo firewall-cmd --permanent --add-port=3306/tcp
sudo firewall-cmd --reload
5Enable SSH debug mode to see detailed tunnel information

Use verbose mode to see exactly where the connection fails:

bash
# Single verbose flag - basic debugging
ssh -v -L 3306:localhost:3306 user@remote-host

# Double verbose flag - more detailed
ssh -vv -L 3306:localhost:3306 user@remote-host

# Triple verbose flag - maximum detail
ssh -vvv -L 3306:localhost:3306 user@remote-host

Look for messages like:
- "Connection refused" - service not running or wrong port
- "Entering interactive session" - tunnel established successfully
- "channel X: open failed" - the actual error point

6Fix bind-to-localhost issues

If the service is only bound to localhost/127.0.0.1 and you need to access it from another interface:

bash
# Edit the service configuration
sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf
# Look for: bind-address = 127.0.0.1
# Change to: bind-address = 0.0.0.0
# Or specify multiple addresses

# After changes, restart the service
sudo systemctl restart mysql

Alternatively, use SSH tunneling to localhost specifically:

bash
# The middle parameter should be localhost, not the hostname
ssh -L 3306:localhost:3306 user@remote-host

Advanced notes

SSH port forwarding operates in two phases: first establishing the SSH connection to the remote server, then creating a tunnel to the target service. This error indicates phase two is failing. The distinction is important because it means your authentication and network connectivity are working—the problem is specifically with the target service accessibility. When using remote port forwarding (ssh -R), ensure the remote host has GatewayPorts enabled in sshd_config if you need to access the forwarded port from other hosts. For security, services should be bound to localhost only, requiring SSH tunneling for remote access rather than exposing them directly.

Frequently asked questions

What does "channel 1: open failed: connect failed: Connection refused" mean?
The "channel open failed: connect failed: Connection refused" error happens specifically during SSH port forwarding operations. Unlike a general SSH connection refused error, this occurs after your SSH connection to the server is established. The SSH client has successfully connected to the remote SSH server, but when it attempts to forward a connection to a service on the remote host (or through to another destination), that service is not accepting connections.
How do I fix "channel 1: open failed: connect failed: Connection refused"?
This error occurs during SSH port forwarding (tunneling) when the target service is not running, listening on the wrong port, or blocked by a firewall. The SSH connection succeeds, but the forwarded connection to the remote service fails.
What causes "channel 1: open failed: connect failed: Connection refused"?
The target service is not running on the remote host (database daemon down, web server stopped, etc.) The service is listening on a different port than specified in the SSH forwarding command A firewall (iptables, firewalld, ufw) on the remote host is blocking connections to the target service port
Is the "channel 1: open failed: connect failed: Connection refused" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading