Tag Info

Hot answers tagged

52

Administratively prohibited generally means you've been blocked by a firewall or equivalent control software. This will be somewhere between localhost and remote. When you connect to the local endpoint on localhost, the other end of the ssh tunnel (also on localhost) will try to establish a connection to remote:8983. This is what is being blocked. You ...


25

channel 1: open failed: administratively prohibited: open failed The above message refers to your SSH server rejecting your SSH client's request to open a side channel. This typically comes from -D, -L or -w, as separate channels in the SSH stream are required to ferry the forwarded data across. Since you are using -L (also applicable to -D), there are two ...


19

I'll start with the raw facts : You have: A - your FreeBSD box, B - your router and C - some machine with Internet access. This is how it looks like: .-----. .-----. .-----. | A | == | B | - - ( Internet ) - - | C | '-----' '-----' '-----' \_________ ________/ v `- this ...


8

Using ssh is the easiest solution. ssh -g -L 8001:localhost:8000 -f -N user@remote-server.com This forwards the local port 8001 on your workstation to the localhost address on remote-server.com port 8000. -g means allow other clients on my network to connect to port 8001 on my workstation. Otherwise only local clients on your workstation can connect ...


8

"administratively prohibited" is a specific ICMP message flag that boils down to "The administrator explicitly wants this connection blocked". Check your iptables settings.


8

You cannot use shaping to limit incoming traffic rates. For that, you need to use policing and it may have limited effectiveness. Shaping controls the rate at which packets are sent out a network interface. The rules you have set up control network egress. Packets arrive at whatever rate the other end is sending them. Policing can help by limiting the ...


8

You can use ss from the iproute2 package (which is similar to netstat): ss -l -p -n | grep ",1234," Replace 1234 with the PID of the program.


7

At least one answer is that the machine "remote" is unreachable with ssh for some reason. The error message is just absurd.


7

If the simulation software really checks that the display number is 0, you can arrange for your remote display to be 0. Make sure you're not running Xsun locally or run it on a different display (e.g. Xsun :1). In the OpenSSH server configuration file /etc/ssh/sshd_config, add the line X11DisplayOffset 0. If you connect over ssh, the DISPLAY environment ...


7

If you're using the SSH command line, and you haven't switched the escape character feature off, then you can type ~C after a newline to open a mini-console on the ssh client. Then type -L port:host:port or -R port:host:port or -D port as you would on the command line to add a redirection, or -KR port to remove a redirection. A more flexible method to set ...


7

That's a tricky thing to get done. Your best bet is to use some SOCKS redirector like socksify or redsocks, but none will give you what a VPN can, so you'd better set it up. VPN allows you to connect even whole networks, forward your traffic through secure channels, make your computers all appear as in one LAN and so on. You can use OpenVPN to do that - ...


7

The iptables rule you are using will work, but there is one additional change you need to make: sysctl -w net.ipv4.conf.eth0.route_localnet=1 (replacing eth0 with the nic 192.168.2.2 resides on) By default this value is 0, which instructs the kernel to not route external traffic destined to 127.0.0.0/8. This is just for security as such traffic is not ...


7

@jofel's answer shows you the appropriate tool to use, ss, here's the replacements for the other networking tools in iproute2. The deprecated commands and their iproute2 equivalents are as follows: deprecated replacement(s) ========== ============== - arp ip n (ip neighbor) - ifconfig ip a (ip addr), ip link, ip -s (ip -stats) - ...


6

A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction. edit See the PermitOpen directive: Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms: PermitOpen host:port PermitOpen ...


6

You need to do three things on your VPN server (the Linode) to make this work: You must enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 Set up destination NAT (DNAT) to forward the port. You've probably already figured this out because it's standard port forwarding stuff, but for completeness: iptables -t nat -A PREROUTING -d x.x.x.x -p tcp ...


6

Try this iptables rule: $ sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination IP:80 The above says to: Add the following rule to the NAT table (-t nat). This rule will be appended (-A) to the outbound traffic (OUTPUT). We're only interested in TCP traffic (-p tcp). We're only interested in traffic who's destination port is 80 ...


6

It's not possible to connect to a port-forwarded public IP address from inside the same LAN. To explain this, I'll need an example. Let's suppose your router's private IP is 192.168.1.1 with public IP 10.1.1.1. Your server is on 192.168.1.2 port 2222. You set up port forwarding from 10.1.1.1:1111 to 192.168.1.2:2222. If somebody on the Internet ...


5

I am thinking you problem is not in the port forwarding, but another option in the NAT config in the router. First, ensure if you use your LAN IP, you can successfully SSH from another machine on the network. This ensures SSH works at all. Second, test from another machine outside the network using the public IP. This ensures that port forwarding works. ...


5

In a very weird case, I also experienced this error while trying to create a local tunnel. My command was something like this: ssh -L 1234:localhost:1234 user@remote The problem was, on the remote host, /etc/hosts had no entry for "localhost" so the ssh server didn't know how to setup the tunnel. A very unfriendly error message for this case; glad I ...


5

You need a reverse tunnel. From your mac you ssh to your linux VPS, creating a reverse tunnel. ssh -R *:6667:127.0.0.1:6667 tristan@linux That connects from your mac-mini to your linux VPS. It makes ssh listen on all interfaces (*) on port 6667. Any traffic it finds (on port 6667 of your VPS) it sucks down the tunnel and punts back into the localhost ...


5

Short answer: yes, ssh can do this. The answer's in your question: "reverse" tunneling. See the -R option to the ssh client: -R [bind_address:]port:host:hostport Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to ...


5

Scriptonaut, probably your problem has nothing to do with Samba, but has to do with port forwarding/NAT. If you have your SAMBA serving Debian computer in a LAN network, behind a router, you need it configured to transfer requests to some of its ports to your SAMBA running machine: First, I'll tell, how outgoing connections work with router. When 2 ...


5

As long as the DD-WRT router is also the DHCP Server for the network, you can set up a static DHCP lease for the server in DD-WRT in Services > DHCP Server under the Static leases section. This will make sure that the DHCP server always hands out the same IP address for your server when it asks for a DHCP lease. In order to do this, you need to know the ...


5

ssh lab_desktop -L 2200:lab_server:22 -vvv ssh lab_desktop - create an ssh connection to lab_desktop as $USER -L 2200:lab_server:22 - using the connection to lab_desktop, forward port 2200 on the local machine to port 22 on lab_server -vvv - enable the maximum verbosity level This command will open a socket on your local machine on port 2200, then ...


5

Usually you would have to setup your web server with virtual hosts and maybe mod_proxy (for Apache). However, I would suggest that you use a reverse proxy such as haproxy to take care of that. Setup Haproxy so that it listens to port 80 and direct your traffic to your webservers using ACLs on the domain name. Setup your webserver with virtual hosts that ...


4

This error definitively pops up when you use ssh options ControlPath and ControlMaster for sharing one socket connection to be reused between several client connections (from one client to the same user@server). Opening too many (whatever it means, in my case ~20 connections) yields this message. Closing any previous connections lets me open newer, again up ...


4

OpenBSD netcat is available by default on Ubuntu and also on OS X. mkfifo a mkfifo b nc 127.0.0.1 8000 < b > a & nc -l 8001 < a > b & An alternative that works on OS X bash is to use a bidirectional pipe. It may work on other Unixes: nc 127.0.0.1 8000 <&1 | nc -l 8001 >&0


4

If the 'remote' cannot be resolved on the server you will get that error. Replace with an IP address and see if that resolves your issue... (Basically same answer as that of Neil - but I certainly found that to be the issue on my side) [I had an alias for the machine name in my ~/.ssh/config file - and the remote machine knew nothing of that alias...


4

I would say tcpdump on the Ubuntu box, and netcat on anything that should act as the client.


4

There's an option no-port-forwarding that you can use, that prevents all port forwarding. Present at least as of OpenSSH 4.3p2 (CentOS 5.3 - oldest machine I have access to). Put it in the same place that you would have put permitopen.



Only top voted, non community-wiki answers of a minimum length are eligible