SSH SOCKS: Connection Refused When Opening a Channel
Read SSH dynamic-forwarding channel errors as failures of the requested onward connection rather than assuming the local SOCKS listener never started.
channel 5: open failed: connect failed: Connection refused concerns an onward connection opened from the SSH server. A local SOCKS listener and a successful SSH login can both be working when that channel fails.
The path has three endpoints: the application contacts the local SOCKS listener, the SSH session carries its request to the server, and the server opens the requested destination connection.
| Channel failure | Next investigation |
|---|---|
| Administrative prohibition | Whether the SSH server permits the requested forwarding operation |
| Onward connection refused | The requested destination host, port and listener as reached from the SSH server |
A service reachable from the laptop may be absent or inaccessible from that server. A loopback destination also belongs to the machine opening the onward connection; it does not automatically refer to the laptop.
Correlate the channel event with the request you need. A page can request many destinations, and one optional asset's refusal need not mean the entire page failed.
If the bytes do not fit this path, check the forwarding mode. A fixed forward carries traffic to its configured service; a dynamic forward accepts SOCKS destination requests. HTTP sent to a SOCKS listener, or SOCKS sent to a fixed web-server forward, fails at a different protocol boundary.
Record the local listener, SSH endpoint and requested destination separately. That identifies which side needs attention; changing the local port cannot start a missing remote service.