I was doing this tutorial, but when it comes to the part where O should run these commands:

local-server#  ssh -NTCf -w 0:0
local-server#  ssh -NTCf -w 1:1

It says:

channel 0: open failed: administratively prohibited: open failed

How can I fix that?

marked as duplicate by Anthony Geoghegan, Anthon, phk, user34720, X Tian Jun 20 '17 at 12:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Are you using the root account as stated in the tutorial: 'from the root account of your local server'? – Lambert Apr 21 '15 at 10:34
  • @Lambert Yes, i'm using root account and commands are sent from a # – Badr Oyd Apr 21 '15 at 10:36
  • You changed the public IP addresses (, to match your own right? – Lambert Apr 21 '15 at 10:37
  • Yes of course, i'm using and – Badr Oyd Apr 21 '15 at 10:38
  • Did you find and read unix.stackexchange.com/questions/14160/…? – Lambert Apr 21 '15 at 10:42

After discussing this in a chat and debugged the issue, it turned out that the required directive PermitTunnel yes was not in place and active. After adding the directive to /etc/ssh/sshd_config and reloading sshd by service sshd reload this was resolved.

We added -v to the ssh command to get some debugging information and from that we found:

debug1: forking to background
root@ubuntu:~# debug1: Entering interactive session.
debug1: Remote: Server has rejected tunnel device forwarding
channel 0: open failed: administratively prohibited: open failed
debug1: channel 0: free: tun, nchannels 1

The server actively rejected the tunnel request which pointed us to the right directive.


This can also happen if the (correctly configured) server has recently updated their kernel, but not yet rebooted.


Just found out that I had a space after the IP address in "HostName x.x.x.x{space_here}" and had this error too:

channel 0: open failed: administratively prohibited: open failed

However it could be seen in logs that there was something strange:

debug1: Executing proxy command: exec ssh -A some-jump -W x.x.x.x\302\240:22

as those \302\240 were quite suspicious.

Not the answer you're looking for? Browse other questions tagged or ask your own question.