diff --git a/lib/client/api.go b/lib/client/api.go
index d70a919d3f6e2..624876f780e98 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -1705,7 +1705,9 @@ func (tc *TeleportClient) SSH(ctx context.Context, command []string, runLocally
 	defer nodeClient.Close()
 
 	// If forwarding ports were specified, start port forwarding.
-	tc.startPortForwarding(ctx, nodeClient)
+	if err := tc.startPortForwarding(ctx, nodeClient); err != nil {
+		return trace.Wrap(err)
+	}
 
 	// If no remote command execution was requested, block on the context which
 	// will unblock upon error or SIGINT.
@@ -1746,14 +1748,13 @@ func (tc *TeleportClient) SSH(ctx context.Context, command []string, runLocally
 	return tc.runShell(ctx, nodeClient, types.SessionPeerMode, nil, nil)
 }
 
-func (tc *TeleportClient) startPortForwarding(ctx context.Context, nodeClient *NodeClient) {
+func (tc *TeleportClient) startPortForwarding(ctx context.Context, nodeClient *NodeClient) error {
 	if len(tc.Config.LocalForwardPorts) > 0 {
 		for _, fp := range tc.Config.LocalForwardPorts {
 			addr := net.JoinHostPort(fp.SrcIP, strconv.Itoa(fp.SrcPort))
 			socket, err := net.Listen("tcp", addr)
 			if err != nil {
-				log.Errorf("Failed to bind to %v: %v.", addr, err)
-				continue
+				return trace.Errorf("Failed to bind to %v: %v.", addr, err)
 			}
 			go nodeClient.listenAndForward(ctx, socket, net.JoinHostPort(fp.DestHost, strconv.Itoa(fp.DestPort)))
 		}
@@ -1763,12 +1764,12 @@ func (tc *TeleportClient) startPortForwarding(ctx context.Context, nodeClient *N
 			addr := net.JoinHostPort(fp.SrcIP, strconv.Itoa(fp.SrcPort))
 			socket, err := net.Listen("tcp", addr)
 			if err != nil {
-				log.Errorf("Failed to bind to %v: %v.", addr, err)
-				continue
+				return trace.Errorf("Failed to bind to %v: %v.", addr, err)
 			}
 			go nodeClient.dynamicListenAndForward(ctx, socket)
 		}
 	}
+	return nil
 }
 
 // Join connects to the existing/active SSH session
@@ -1850,7 +1851,9 @@ func (tc *TeleportClient) Join(ctx context.Context, mode types.SessionParticipan
 	defer nc.Close()
 
 	// Start forwarding ports if configured.
-	tc.startPortForwarding(ctx, nc)
+	if err := tc.startPortForwarding(ctx, nc); err != nil {
+		return trace.Wrap(err)
+	}
 
 	presenceCtx, presenceCancel := context.WithCancel(ctx)
 	defer presenceCancel()