Tag Info

Hot answers tagged

30

Administratively prohibited generally means you've been blocked by a firewall or equivalent control software. This will be somewhere between localhost and remote. When you connect to the local endpoint on localhost, the other end of the ssh tunnel (also on localhost) will try to establish a connection to remote:8983. This is what is being blocked. You ...


16

I'll start with the raw facts : You have: A - your FreeBSD box, B - your router and C - some machine with Internet access. This is how it looks like: .-----. .-----. .-----. | A | == | B | - - ( Internet ) - - | C | '-----' '-----' '-----' \_________ ________/ v `- this ...


14

channel 1: open failed: administratively prohibited: open failed The above message refers to your SSH server rejecting your SSH client's request to open a side channel. This typically comes from -D, -L or -w, as separate channels in the SSH stream are required to ferry the forwarded data across. Since you are using -L (also applicable to -D), there are two ...


7

If the simulation software really checks that the display number is 0, you can arrange for your remote display to be 0. Make sure you're not running Xsun locally or run it on a different display (e.g. Xsun :1). In the OpenSSH server configuration file /etc/ssh/sshd_config, add the line X11DisplayOffset 0. If you connect over ssh, the DISPLAY environment ...


7

Using ssh is the easiest solution. ssh -g -L 8001:localhost:8000 -f -N user@remote-server.com This forwards the local port 8001 on your workstation to the localhost address on remote-server.com port 8000. -g means allow other clients on my network to connect to port 8001 on my workstation. Otherwise only local clients on your workstation can connect ...


7

You cannot use shaping to limit incoming traffic rates. For that, you need to use policing and it may have limited effectiveness. Shaping controls the rate at which packets are sent out a network interface. The rules you have set up control network egress. Packets arrive at whatever rate the other end is sending them. Policing can help by limiting the ...


5

Short answer: yes, ssh can do this. The answer's in your question: "reverse" tunneling. See the -R option to the ssh client: -R [bind_address:]port:host:hostport Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to ...


5

You need a reverse tunnel. From your mac you ssh to your linux VPS, creating a reverse tunnel. ssh -R *:6667:127.0.0.1:6667 tristan@linux That connects from your mac-mini to your linux VPS. It makes ssh listen on all interfaces (*) on port 6667. Any traffic it finds (on port 6667 of your VPS) it sucks down the tunnel and punts back into the localhost ...


5

A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction. edit See the PermitOpen directive: Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms: PermitOpen host:port PermitOpen ...


5

I am thinking you problem is not in the port forwarding, but another option in the NAT config in the router. First, ensure if you use your LAN IP, you can successfully SSH from another machine on the network. This ensures SSH works at all. Second, test from another machine outside the network using the public IP. This ensures that port forwarding works. ...


5

That's a tricky thing to get done. Your best bet is to use some SOCKS redirector like socksify or redsocks, but none will give you what a VPN can, so you'd better set it up. VPN allows you to connect even whole networks, forward your traffic through secure channels, make your computers all appear as in one LAN and so on. You can use OpenVPN to do that - ...


4

If you're using the SSH command line, and you haven't switched the escape character feature off, then you can type ~C after a newline to open a mini-console on the ssh client. Then type -L port:host:port or -R port:host:port or -D port as you would on the command line to add a redirection, or -KR port to remove a redirection. A more flexible method to set ...


4

Scriptonaut, probably your problem has nothing to do with Samba, but has to do with port forwarding/NAT. If you have your SAMBA serving Debian computer in a LAN network, behind a router, you need it configured to transfer requests to some of its ports to your SAMBA running machine: First, I'll tell, how outgoing connections work with router. When 2 ...


4

The reason why you don't see LISTEN on the minecraft server port is due to the way the UDP protocol works. A server that uses the TCP protocol "listens" for a connection so that when a client tries to connect, it will commence a session and transfer data using the TCP/IP protocol. If there is nothing "listening" on a certain port for TCP connections, the ...


4

Looking closer at your question, it appears you're using the same computer from both in- and outside of the LAN. I have revised my answer accordingly: In your ~/.ssh/config, add: Host raspi-wan HostName 12.34.56.78 User john Port 1234 Host raspi-lan HostName 192.168.1.2 User john Port 22 Then, you can ssh raspi-wan from outside ...


4

Unfortunately, that is not possible with -o. The list of ssh options supported by sshfs can be found in the source code: static const char *ssh_opts[] = { "AddressFamily", "BatchMode", "BindAddress", "ChallengeResponseAuthentication", "CheckHostIP", "Cipher", "Ciphers", "Compression", ...


3

I am struggling to see how this could work in practice. The usual use of port mirroring is to monitor the packets going via a particular interface without actively taking part in the network protocol. Passing the TCP packets to applications on port 80 and 8080 requires the there are two target TCP endpoints talking back to a single source TCP endpoint. This ...


3

This error definitively pops up when you use ssh options ControlPath and ControlMaster for sharing one socket connection to be reused between several client connections (from one client to the same user@server). Opening too many (whatever it means, in my case ~20 connections) yields this message. Closing any previous connections lets me open newer, again up ...


3

Yes, this is called GatewayPorts in SSH. An excerpt from ssh_config(5): GatewayPorts Specifies whether remote hosts are allowed to connect to local forwarded ports. By default, ssh(1) binds local port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can ...


3

You need to do three things on your VPN server (the Linode) to make this work: You must enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 Set up destination NAT (DNAT) to forward the port. You've probably already figured this out because it's standard port forwarding stuff, but for completeness: iptables -t nat -A PREROUTING -d x.x.x.x -p tcp ...


3

Masquerading: All machines in your internal network appear at the same (set of) public addresses. I.e., you can have 8 public IP addresses, and a network of 200 machines with private addresses using them to go "outside". When a host inside wants to open a connection to the outside, the connection gets assigned an ID address and port from this pool. It was ...


3

The -D option enables a SOCKS4/5 server. It is not identical to an normal HTTP/FTP-proxy and need therefore to be interfaced differently. A lot of browser support SOCKS proxies, but usually not via a http_proxy/ftp_proxy environment variable. You can wrap programs, which do not support SOCKS directly, with tsocks. See also ...


3

You can do this through ssh's ProxyCommand facility. Add the following to your $HOME/.ssh/config file. Create it if it doesn't exist with just this content: Host remoteserverX User userint ProxyCommand ssh userext@externalserver nc remoteserverX %p Host remoteserverY User userint ProxyCommand ssh userext@externalserver nc remoteserverY %p ...


3

It's not possible to connect to a port-forwarded public IP address from inside the same LAN. To explain this, I'll need an example. Let's suppose your router's private IP is 192.168.1.1 with public IP 10.1.1.1. Your server is on 192.168.1.2 port 2222. You set up port forwarding from 10.1.1.1:1111 to 192.168.1.2:2222. If somebody on the Internet ...


2

There are a couple of ways to accomplish this, the easiest is probably to set up what's known as a DMZ. The more secure way however is on your router to set up a static route on port 22 to your server's IP. Also you might want to take a look at the following link: http://kbserver.netgear.com/kb_web_files/n101145.asp


2

Am I right in thinking you've got your computer (computer A), and say two servers (A and B) which you can't connect to directly on a certain port and so want to tunnel to them over SSH? If so, you create two tunnels from your machine (one to each target server) on different local ports using -L not -D, and then in your monitoring tool you connect to your ...


2

From the ssh manpage: -D [bind_address:]port Specifies a local “dynamic” application-level port forwarding. This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the ...


2

You want the first set. Regarding the OpenBSD documentation you can consult the man page for the most accurate info, if you don't have them installed you can get them from OpenBSDs site: http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf&apropos=0&sektion=0&manpath=OpenBSD+4.7&arch=amd64&format=html They keep all versions and there ...


2

If the 'remote' cannot be resolved on the server you will get that error. Replace with an IP address and see if that resolves your issue... (Basically same answer as that of Neil - but I certainly found that to be the issue on my side) [I had an alias for the machine name in my ~/.ssh/config file - and the remote machine knew nothing of that alias...


2

Some troubleshooting activity is needed to find a definitive answer: check that port forwarding is enabled in user's ssh configuration, enable verbosity of ssh (-v), check ssh logs on local host and secure logs on remote one, test different remote port, check your iptables settings (as Shadur said).



Only top voted, non community-wiki answers of a minimum length are eligible