Tag Info

Hot answers tagged

42

Administratively prohibited generally means you've been blocked by a firewall or equivalent control software. This will be somewhere between localhost and remote. When you connect to the local endpoint on localhost, the other end of the ssh tunnel (also on localhost) will try to establish a connection to remote:8983. This is what is being blocked. You ...


20

channel 1: open failed: administratively prohibited: open failed The above message refers to your SSH server rejecting your SSH client's request to open a side channel. This typically comes from -D, -L or -w, as separate channels in the SSH stream are required to ferry the forwarded data across. Since you are using -L (also applicable to -D), there are two ...


16

I'll start with the raw facts : You have: A - your FreeBSD box, B - your router and C - some machine with Internet access. This is how it looks like: .-----. .-----. .-----. | A | == | B | - - ( Internet ) - - | C | '-----' '-----' '-----' \_________ ________/ v `- this ...


8

"administratively prohibited" is a specific ICMP message flag that boils down to "The administrator explicitly wants this connection blocked". Check your iptables settings.


8

You cannot use shaping to limit incoming traffic rates. For that, you need to use policing and it may have limited effectiveness. Shaping controls the rate at which packets are sent out a network interface. The rules you have set up control network egress. Packets arrive at whatever rate the other end is sending them. Policing can help by limiting the ...


7

Using ssh is the easiest solution. ssh -g -L 8001:localhost:8000 -f -N user@remote-server.com This forwards the local port 8001 on your workstation to the localhost address on remote-server.com port 8000. -g means allow other clients on my network to connect to port 8001 on my workstation. Otherwise only local clients on your workstation can connect ...


7

If the simulation software really checks that the display number is 0, you can arrange for your remote display to be 0. Make sure you're not running Xsun locally or run it on a different display (e.g. Xsun :1). In the OpenSSH server configuration file /etc/ssh/sshd_config, add the line X11DisplayOffset 0. If you connect over ssh, the DISPLAY environment ...


6

A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction. edit See the PermitOpen directive: Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms: PermitOpen host:port PermitOpen ...


6

At least one answer is that the machine "remote" is unreachable with ssh for some reason. The error message is just absurd.


6

That's a tricky thing to get done. Your best bet is to use some SOCKS redirector like socksify or redsocks, but none will give you what a VPN can, so you'd better set it up. VPN allows you to connect even whole networks, forward your traffic through secure channels, make your computers all appear as in one LAN and so on. You can use OpenVPN to do that - ...


6

It's not possible to connect to a port-forwarded public IP address from inside the same LAN. To explain this, I'll need an example. Let's suppose your router's private IP is 192.168.1.1 with public IP 10.1.1.1. Your server is on 192.168.1.2 port 2222. You set up port forwarding from 10.1.1.1:1111 to 192.168.1.2:2222. If somebody on the Internet ...


5

You need a reverse tunnel. From your mac you ssh to your linux VPS, creating a reverse tunnel. ssh -R *:6667:127.0.0.1:6667 tristan@linux That connects from your mac-mini to your linux VPS. It makes ssh listen on all interfaces (*) on port 6667. Any traffic it finds (on port 6667 of your VPS) it sucks down the tunnel and punts back into the localhost ...


5

Short answer: yes, ssh can do this. The answer's in your question: "reverse" tunneling. See the -R option to the ssh client: -R [bind_address:]port:host:hostport Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to ...


5

I am thinking you problem is not in the port forwarding, but another option in the NAT config in the router. First, ensure if you use your LAN IP, you can successfully SSH from another machine on the network. This ensures SSH works at all. Second, test from another machine outside the network using the public IP. This ensures that port forwarding works. ...


5

As long as the DD-WRT router is also the DHCP Server for the network, you can set up a static DHCP lease for the server in DD-WRT in Services > DHCP Server under the Static leases section. This will make sure that the DHCP server always hands out the same IP address for your server when it asks for a DHCP lease. In order to do this, you need to know the ...


5

ssh lab_desktop -L 2200:lab_server:22 -vvv ssh lab_desktop - create an ssh connection to lab_desktop as $USER -L 2200:lab_server:22 - using the connection to lab_desktop, forward port 2200 on the local machine to port 22 on lab_server -vvv - enable the maximum verbosity level This command will open a socket on your local machine on port 2200, then ...


4

I would say tcpdump on the Ubuntu box, and netcat on anything that should act as the client.


4

This error definitively pops up when you use ssh options ControlPath and ControlMaster for sharing one socket connection to be reused between several client connections (from one client to the same user@server). Opening too many (whatever it means, in my case ~20 connections) yields this message. Closing any previous connections lets me open newer, again up ...


4

If you're using the SSH command line, and you haven't switched the escape character feature off, then you can type ~C after a newline to open a mini-console on the ssh client. Then type -L port:host:port or -R port:host:port or -D port as you would on the command line to add a redirection, or -KR port to remove a redirection. A more flexible method to set ...


4

Scriptonaut, probably your problem has nothing to do with Samba, but has to do with port forwarding/NAT. If you have your SAMBA serving Debian computer in a LAN network, behind a router, you need it configured to transfer requests to some of its ports to your SAMBA running machine: First, I'll tell, how outgoing connections work with router. When 2 ...


4

You need to do three things on your VPN server (the Linode) to make this work: You must enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 Set up destination NAT (DNAT) to forward the port. You've probably already figured this out because it's standard port forwarding stuff, but for completeness: iptables -t nat -A PREROUTING -d x.x.x.x -p tcp ...


4

There's an option no-port-forwarding that you can use, that prevents all port forwarding. Present at least as of OpenSSH 4.3p2 (CentOS 5.3 - oldest machine I have access to). Put it in the same place that you would have put permitopen.


4

Masquerading: All machines in your internal network appear at the same (set of) public addresses. I.e., you can have 8 public IP addresses, and a network of 200 machines with private addresses using them to go "outside". When a host inside wants to open a connection to the outside, the connection gets assigned an ID address and port from this pool. It was ...


4

Try this iptables rule: $ sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination IP:80 The above says to: Add the following rule to the NAT table (-t nat). This rule will be appended (-A) to the outbound traffic (OUTPUT). We're only interested in TCP traffic (-p tcp). We're only interested in traffic who's destination port is 80 ...


4

The reason why you don't see LISTEN on the minecraft server port is due to the way the UDP protocol works. A server that uses the TCP protocol "listens" for a connection so that when a client tries to connect, it will commence a session and transfer data using the TCP/IP protocol. If there is nothing "listening" on a certain port for TCP connections, the ...


4

Looking closer at your question, it appears you're using the same computer from both in- and outside of the LAN. I have revised my answer accordingly: In your ~/.ssh/config, add: Host raspi-wan HostName 12.34.56.78 User john Port 1234 Host raspi-lan HostName 192.168.1.2 User john Port 22 Then, you can ssh raspi-wan from outside ...


4

Unfortunately, that is not possible with -o. The list of ssh options supported by sshfs can be found in the source code: static const char *ssh_opts[] = { "AddressFamily", "BatchMode", "BindAddress", "ChallengeResponseAuthentication", "CheckHostIP", "Cipher", "Ciphers", "Compression", ...


4

This should be configured on whatever equipment you have between the DNS server and the outside world. AFAIK port forwarding is disabled by default on pretty much everything so you shouldn't worry too much about it. If you're using residential network gear, there should be port forwarding configuration options in the web interface. To check the port ...


4

ssh -L 2200:lab_server:22 -vvv lab_desktop will do the following: It is being verbose on the maximum level (3), meaning it will print debug level 3 information. An example is: debug3: channel 0: will not send data after close The -L lets you tunnel your data via the given port 2200 on your side lab_desktop to the lab_server on port 22. So if you ...


4

Usually you would have to setup your web server with virtual hosts and maybe mod_proxy (for Apache). However, I would suggest that you use a reverse proxy such as haproxy to take care of that. Setup Haproxy so that it listens to port 80 and direct your traffic to your webservers using ACLs on the domain name. Setup your webserver with virtual hosts that ...



Only top voted, non community-wiki answers of a minimum length are eligible