How to fix channel 2: open failed: connect failed: Connection timed out in SSH

First confirm that the basic SSH connection to the remote server succeeds:

ssh -v [email protected]

If this fails, you have an SSH authentication issue, not a channel issue. Fix basic SSH connectivity before proceeding. If this works, continue to the next step.

SSH into the remote server and try connecting to the destination host directly:

ssh [email protected]
# Now you're on the remote server
nc -zv destination-host 8080
# or
curl -v http://destination-host:8080/

If this fails, the destination is unreachable from the remote server. Check:
- Destination host/port is correct
- Destination service is running
- Network routing allows the connection
- Firewall on destination allows inbound connections

By default, SSH waits 30 seconds for channel connections. Increase this:

ssh -o ConnectTimeout=60 -L 8080:localhost:8080 [email protected]

This gives 60 seconds instead of 30. If the destination is just slow to respond, this may help. However, if the destination is truly unreachable, increasing timeout just delays the error.

On the SSH server, verify TCP forwarding is enabled. SSH into the server and check /etc/ssh/sshd_config:

grep -i AllowTcpForwarding /etc/ssh/sshd_config

Should return:

AllowTcpForwarding yes

If it says "no" or is commented out, edit the file:

sudo nano /etc/ssh/sshd_config
# Find or add the line:
AllowTcpForwarding yes

Then restart SSH:

sudo systemctl restart sshd

If the SSH server has a local firewall, it may block the outbound connection to the destination. Check and allow the destination:

# Check current rules
sudo iptables -L -n | grep destination-port

# Allow traffic to destination (example for port 8080)
sudo iptables -A OUTPUT -o eth0 -p tcp --dport 8080 -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j ACCEPT

# Make persistent (depends on your system)
sudo ufw allow out to any port 8080

Or if using firewalld:

sudo firewall-cmd --permanent --add-forward-port=port=8080:proto=tcp:toaddr=destination-host:toport=8080
sudo firewall-cmd --reload

If forwarding to localhost on the SSH server:

ssh -L 8080:127.0.0.1:8080 [email protected]

The destination "127.0.0.1:8080" is evaluated on the remote server, not locally. If the service listens on localhost (127.0.0.1), this works. If it listens on a specific interface, use that instead:

ssh -L 8080:192.168.1.10:8080 [email protected]

Add verbose flags to see detailed connection attempts:

ssh -vvv -L 8080:localhost:8080 [email protected]

Look for lines like:
- "Requesting port forward..." (channel opens)
- "connect failed: Connection timed out" (actual failure point)

The verbose output will show exactly which part of the connection fails.