docs: note Windows WinNAT port reservations breaking SSH tunnels

openhands/usage/troubleshooting/troubleshooting.mdx

@@ -70,6 +70,39 @@ way forbidden by its access permissions.")` is encountered.
 Restart-Service -Name "winnat"
 ```
 
+### SSH port forwarding fails with "bind: Permission denied"
+
+**Description**
+
+When reaching OpenHands over an SSH tunnel, the browser connects directly to the sandbox's randomly assigned host port, so that port must be forwarded alongside the app port:
+
+```bash theme={null}
+ssh -N -L <app-port>:127.0.0.1:<app-port> -L 41549:127.0.0.1:41549 user@host
+```
+
+On Windows the forward itself can fail:
+
+```
+bind [127.0.0.1]:41549: Permission denied
+channel_setup_fwd_listener_tcpip: cannot listen to port: 41549
+```
+
+WinNAT, Hyper-V and WSL dynamically reserve blocks of ports inside the same range the sandbox allocates from. These dynamic reservations do not reliably appear in the exclusion table, so a port outside every listed range can still be unbindable:
+
+```powershell theme={null}
+netsh interface ipv4 show excludedportrange protocol=tcp
+```
+
+**Resolution**
+
+Stop WinNAT in PowerShell as Administrator, start the SSH tunnel in another window, then restart WinNAT. The already-open tunnel survives:
+
+```powershell theme={null}
+net stop winnat
+# start the SSH tunnel in another window, then:
+net start winnat
+```
+
 ### Unable to access VS Code tab via local IP
 
 **Description**