Tag Info

Hot answers tagged

33

Administratively prohibited generally means you've been blocked by a firewall or equivalent control software. This will be somewhere between localhost and remote. When you connect to the local endpoint on localhost, the other end of the ssh tunnel (also on localhost) will try to establish a connection to remote:8983. This is what is being blocked. You ...


16

I'll start with the raw facts : You have: A - your FreeBSD box, B - your router and C - some machine with Internet access. This is how it looks like: .-----. .-----. .-----. | A | == | B | - - ( Internet ) - - | C | '-----' '-----' '-----' \_________ ________/ v `- this ...


15

channel 1: open failed: administratively prohibited: open failed The above message refers to your SSH server rejecting your SSH client's request to open a side channel. This typically comes from -D, -L or -w, as separate channels in the SSH stream are required to ferry the forwarded data across. Since you are using -L (also applicable to -D), there are two ...


8

"administratively prohibited" is a specific ICMP message flag that boils down to "The administrator explicitly wants this connection blocked". Check your iptables settings.


8

You cannot use shaping to limit incoming traffic rates. For that, you need to use policing and it may have limited effectiveness. Shaping controls the rate at which packets are sent out a network interface. The rules you have set up control network egress. Packets arrive at whatever rate the other end is sending them. Policing can help by limiting the ...


7

If the simulation software really checks that the display number is 0, you can arrange for your remote display to be 0. Make sure you're not running Xsun locally or run it on a different display (e.g. Xsun :1). In the OpenSSH server configuration file /etc/ssh/sshd_config, add the line X11DisplayOffset 0. If you connect over ssh, the DISPLAY environment ...


7

Using ssh is the easiest solution. ssh -g -L 8001:localhost:8000 -f -N user@remote-server.com This forwards the local port 8001 on your workstation to the localhost address on remote-server.com port 8000. -g means allow other clients on my network to connect to port 8001 on my workstation. Otherwise only local clients on your workstation can connect ...


5

You need a reverse tunnel. From your mac you ssh to your linux VPS, creating a reverse tunnel. ssh -R *:6667:127.0.0.1:6667 tristan@linux That connects from your mac-mini to your linux VPS. It makes ssh listen on all interfaces (*) on port 6667. Any traffic it finds (on port 6667 of your VPS) it sucks down the tunnel and punts back into the localhost ...


5

Short answer: yes, ssh can do this. The answer's in your question: "reverse" tunneling. See the -R option to the ssh client: -R [bind_address:]port:host:hostport Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to ...


5

A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction. edit See the PermitOpen directive: Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms: PermitOpen host:port PermitOpen ...


5

I am thinking you problem is not in the port forwarding, but another option in the NAT config in the router. First, ensure if you use your LAN IP, you can successfully SSH from another machine on the network. This ensures SSH works at all. Second, test from another machine outside the network using the public IP. This ensures that port forwarding works. ...


5

That's a tricky thing to get done. Your best bet is to use some SOCKS redirector like socksify or redsocks, but none will give you what a VPN can, so you'd better set it up. VPN allows you to connect even whole networks, forward your traffic through secure channels, make your computers all appear as in one LAN and so on. You can use OpenVPN to do that - ...


5

As long as the DD-WRT router is also the DHCP Server for the network, you can set up a static DHCP lease for the server in DD-WRT in Services > DHCP Server under the Static leases section. This will make sure that the DHCP server always hands out the same IP address for your server when it asks for a DHCP lease. In order to do this, you need to know the ...


5

ssh lab_desktop -L 2200:lab_server:22 -vvv ssh lab_desktop - create an ssh connection to lab_desktop as $USER -L 2200:lab_server:22 - using the connection to lab_desktop, forward port 2200 on the local machine to port 22 on lab_server -vvv - enable the maximum verbosity level This command will open a socket on your local machine on port 2200, then ...


4

I would say tcpdump on the Ubuntu box, and netcat on anything that should act as the client.


4

If you're using the SSH command line, and you haven't switched the escape character feature off, then you can type ~C after a newline to open a mini-console on the ssh client. Then type -L port:host:port or -R port:host:port or -D port as you would on the command line to add a redirection, or -KR port to remove a redirection. A more flexible method to set ...


4

Scriptonaut, probably your problem has nothing to do with Samba, but has to do with port forwarding/NAT. If you have your SAMBA serving Debian computer in a LAN network, behind a router, you need it configured to transfer requests to some of its ports to your SAMBA running machine: First, I'll tell, how outgoing connections work with router. When 2 ...


4

Masquerading: All machines in your internal network appear at the same (set of) public addresses. I.e., you can have 8 public IP addresses, and a network of 200 machines with private addresses using them to go "outside". When a host inside wants to open a connection to the outside, the connection gets assigned an ID address and port from this pool. It was ...


4

The reason why you don't see LISTEN on the minecraft server port is due to the way the UDP protocol works. A server that uses the TCP protocol "listens" for a connection so that when a client tries to connect, it will commence a session and transfer data using the TCP/IP protocol. If there is nothing "listening" on a certain port for TCP connections, the ...


4

Looking closer at your question, it appears you're using the same computer from both in- and outside of the LAN. I have revised my answer accordingly: In your ~/.ssh/config, add: Host raspi-wan HostName 12.34.56.78 User john Port 1234 Host raspi-lan HostName 192.168.1.2 User john Port 22 Then, you can ssh raspi-wan from outside ...


4

Unfortunately, that is not possible with -o. The list of ssh options supported by sshfs can be found in the source code: static const char *ssh_opts[] = { "AddressFamily", "BatchMode", "BindAddress", "ChallengeResponseAuthentication", "CheckHostIP", "Cipher", "Ciphers", "Compression", ...


4

ssh -L 2200:lab_server:22 -vvv lab_desktop will do the following: It is being verbose on the maximum level (3), meaning it will print debug level 3 information. An example is: debug3: channel 0: will not send data after close The -L lets you tunnel your data via the given port 2200 on your side lab_desktop to the lab_server on port 22. So if you ...


3

This error definitively pops up when you use ssh options ControlPath and ControlMaster for sharing one socket connection to be reused between several client connections (from one client to the same user@server). Opening too many (whatever it means, in my case ~20 connections) yields this message. Closing any previous connections lets me open newer, again up ...


3

At least one answer is that the machine "remote" is unreachable with ssh for some reason. The error message is just absurd.


3

I am struggling to see how this could work in practice. The usual use of port mirroring is to monitor the packets going via a particular interface without actively taking part in the network protocol. Passing the TCP packets to applications on port 80 and 8080 requires the there are two target TCP endpoints talking back to a single source TCP endpoint. This ...


3

You need to do three things on your VPN server (the Linode) to make this work: You must enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 Set up destination NAT (DNAT) to forward the port. You've probably already figured this out because it's standard port forwarding stuff, but for completeness: iptables -t nat -A PREROUTING -d x.x.x.x -p tcp ...


3

Yes, this is called GatewayPorts in SSH. An excerpt from ssh_config(5): GatewayPorts Specifies whether remote hosts are allowed to connect to local forwarded ports. By default, ssh(1) binds local port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can ...


3

There's an option no-port-forwarding that you can use, that prevents all port forwarding. Present at least as of OpenSSH 4.3p2 (CentOS 5.3 - oldest machine I have access to). Put it in the same place that you would have put permitopen.


3

The -D option enables a SOCKS4/5 server. It is not identical to an normal HTTP/FTP-proxy and need therefore to be interfaced differently. A lot of browser support SOCKS proxies, but usually not via a http_proxy/ftp_proxy environment variable. You can wrap programs, which do not support SOCKS directly, with tsocks. See also ...


3

You can do this through ssh's ProxyCommand facility. Add the following to your $HOME/.ssh/config file. Create it if it doesn't exist with just this content: Host remoteserverX User userint ProxyCommand ssh userext@externalserver nc remoteserverX %p Host remoteserverY User userint ProxyCommand ssh userext@externalserver nc remoteserverY %p ...



Only top voted, non community-wiki answers of a minimum length are eligible