Hot answers tagged

66

Administratively prohibited generally means you've been blocked by a firewall or equivalent control software. This will be somewhere between localhost and remote. When you connect to the local endpoint on localhost, the other end of the ssh tunnel (also on localhost) will try to establish a connection to remote:8983. This is what is being blocked. You ...


34

channel 1: open failed: administratively prohibited: open failed The above message refers to your SSH server rejecting your SSH client's request to open a side channel. This typically comes from -D, -L or -w, as separate channels in the SSH stream are required to ferry the forwarded data across. Since you are using -L (also applicable to -D), there are two ...


26

I'll start with the raw facts : You have: A - your FreeBSD box, B - your router and C - some machine with Internet access. This is how it looks like: .-----. .-----. .-----. | A | == | B | - - ( Internet ) - - | C | '-----' '-----' '-----' \_________ ________/ v `- this ...


18

The iptables rule you are using will work, but there is one additional change you need to make: sysctl -w net.ipv4.conf.eth0.route_localnet=1 (replacing eth0 with the nic 192.168.2.2 resides on) By default this value is 0, which instructs the kernel to not route external traffic destined to 127.0.0.0/8. This is just for security as such traffic is not ...


14

You can use ss from the iproute2 package (which is similar to netstat): ss -l -p -n | grep ",1234," Replace 1234 with the PID of the program.


13

Using ssh is the easiest solution. ssh -g -L 8001:localhost:8000 -f -N user@remote-server.com This forwards the local port 8001 on your workstation to the localhost address on remote-server.com port 8000. -g means allow other clients on my network to connect to port 8001 on my workstation. Otherwise only local clients on your workstation can connect ...


12

With socat on the server: socat tcp-listen:8001,reuseaddr,fork tcp:localhost:8000


12

I am not aware of a way using iproute2 tools. But as a workaround, you could try this one out. lsof -Pan -p PID -i should give you the information you are looking for. Output lsof -Pan -p 27808 -i COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 27808 apache 5u IPv6 112811294 0t0 TCP *:80 (LISTEN) httpd 27808 apache ...


10

1 - general case Suppose you have two server in a company network. From local server "L1" you have access to a remote server "R1" via ssh on port 22. The server R1 host a web service, but firewall/NAT/whatever block direct access to port 80. "R1" can't access "L1" directly due to NAT issue. from L1 you connect using (same user on both host) ssh -L ...


10

At least one answer is that the machine "remote" is unreachable with ssh for some reason. The error message is just absurd.


9

If you're using the SSH command line, and you haven't switched the escape character feature off, then you can type ~C after a newline to open a mini-console on the ssh client. Then type -L port:host:port or -R port:host:port or -D port as you would on the command line to add a redirection, or -KR port to remove a redirection. A more flexible method to set ...


9

You need to do three things on your VPN server (the Linode) to make this work: You must enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 Set up destination NAT (DNAT) to forward the port. You've probably already figured this out because it's standard port forwarding stuff, but for completeness: iptables -t nat -A PREROUTING -d x.x.x.x -p tcp ...


8

You cannot use shaping to limit incoming traffic rates. For that, you need to use policing and it may have limited effectiveness. Shaping controls the rate at which packets are sent out a network interface. The rules you have set up control network egress. Packets arrive at whatever rate the other end is sending them. Policing can help by limiting the ...


8

Try this iptables rule: $ sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination IP:80 The above says to: Add the following rule to the NAT table (-t nat). This rule will be appended (-A) to the outbound traffic (OUTPUT). We're only interested in TCP traffic (-p tcp). We're only interested in traffic who's destination port is 80 ...


8

"administratively prohibited" is a specific ICMP message flag that boils down to "The administrator explicitly wants this connection blocked". Check your iptables settings.


8

@jofel's answer shows you the appropriate tool to use, ss, here's the replacements for the other networking tools in iproute2. The deprecated commands and their iproute2 equivalents are as follows: deprecated replacement(s) ========== ============== - arp ip n (ip neighbor) - ifconfig ip a (ip addr), ip link, ip -s (ip -stats) - ...


7

If the 'remote' cannot be resolved on the server you will get that error. Replace with an IP address and see if that resolves your issue... (Basically same answer as that of Neil - but I certainly found that to be the issue on my side) [I had an alias for the machine name in my ~/.ssh/config file - and the remote machine knew nothing of that alias...


7

A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction. edit See the PermitOpen directive: Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms: PermitOpen host:port PermitOpen ...


7

If the simulation software really checks that the display number is 0, you can arrange for your remote display to be 0. Make sure you're not running Xsun locally or run it on a different display (e.g. Xsun :1). In the OpenSSH server configuration file /etc/ssh/sshd_config, add the line X11DisplayOffset 0. If you connect over ssh, the DISPLAY environment ...


7

It's not possible to connect to a port-forwarded public IP address from inside the same LAN. To explain this, I'll need an example. Let's suppose your router's private IP is 192.168.1.1 with public IP 10.1.1.1. Your server is on 192.168.1.2 port 2222. You set up port forwarding from 10.1.1.1:1111 to 192.168.1.2:2222. If somebody on the Internet ...


7

That's a tricky thing to get done. Your best bet is to use some SOCKS redirector like socksify or redsocks, but none will give you what a VPN can, so you'd better set it up. VPN allows you to connect even whole networks, forward your traffic through secure channels, make your computers all appear as in one LAN and so on. You can use OpenVPN to do that - ...


6

In a very weird case, I also experienced this error while trying to create a local tunnel. My command was something like this: ssh -L 1234:localhost:1234 user@remote The problem was, on the remote host, /etc/hosts had no entry for "localhost" so the ssh server didn't know how to setup the tunnel. A very unfriendly error message for this case; glad I ...


6

OpenBSD netcat is available by default on Ubuntu and also on OS X. mkfifo a mkfifo b nc 127.0.0.1 8000 < b > a & nc -l 8001 < a > b & An alternative that works on OS X bash is to use a bidirectional pipe. It may work on other Unixes: nc 127.0.0.1 8000 <&1 | nc -l 8001 >&0


6

Usually you would have to setup your web server with virtual hosts and maybe mod_proxy (for Apache). However, I would suggest that you use a reverse proxy such as haproxy to take care of that. Setup Haproxy so that it listens to port 80 and direct your traffic to your webservers using ACLs on the domain name. Setup your webserver with virtual hosts that ...


6

This should be configured on whatever equipment you have between the DNS server and the outside world. AFAIK port forwarding is disabled by default on pretty much everything so you shouldn't worry too much about it. If you're using residential network gear, there should be port forwarding configuration options in the web interface. To check the port ...


6

You have 2 options here. Option 1: Put ssh to listen on a different port, by editing the file /etc/ssh/sshd_config and changing the Port parameter to another number of port. Port 2222 as an example. Option 2: Redirect the traffic incoming from another port to tcp/22(ssh) iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p ...


5

I like to use sslh for this. It exploits the fact that different protocols start a connection differently. If it detects SSH, it forwards the connection to sshd and if it detects HTTPS it forwards the connection to httpd. This allows you to have e.g. nginx/apache and ssh listening on the same port (usually 443).


5

As long as the DD-WRT router is also the DHCP Server for the network, you can set up a static DHCP lease for the server in DD-WRT in Services > DHCP Server under the Static leases section. This will make sure that the DHCP server always hands out the same IP address for your server when it asks for a DHCP lease. In order to do this, you need to know the ...


5

ssh lab_desktop -L 2200:lab_server:22 -vvv ssh lab_desktop - create an ssh connection to lab_desktop as $USER -L 2200:lab_server:22 - using the connection to lab_desktop, forward port 2200 on the local machine to port 22 on lab_server -vvv - enable the maximum verbosity level This command will open a socket on your local machine on port 2200, then ...


5

I ended up using some SSH ~/.ssh/config hacks to make this happen: Host hopper User naftuli ForwardAgent yes Host overthere User naftuli ForwardAgent yes ProxyCommand ssh -q hopper nc overthere 22 What this does is that when I attempt to connect to ssh overthere from sittinghere, it connects to hopper and then proxies the SSH ...



Only top voted, non community-wiki answers of a minimum length are eligible