On creating a VNC connection via tunneled SSH connection, I get an error:

channel 3: open failed: administratively prohibited: open failed

I have found that this happens only when I'm not logged into the host locally as the username on the host I'm trying to connect to using a tunneled VNC connection. SSH Tunnel:

ssh -p 6000 -L 5901: username@

VNC connection:

vncviewer localhost:1

I've tried adjusting the settings in /etc/ssh/sshd_config using AllowTunnel yes and without the setting. (I did restart ssh after each change: service ssh restart) However, the error goes away if I have a local session running on the remote host (i.e. I'm logged in as username locally.) Is anyone else seeing this behavior? It seems like I should be able to start a VNC remotely and access it with out having to logged in locally as well.

  • 1
    Mike, please check the tour to see how does this site work and if my answer solved your problem, please accept it.
    – Jakuje
    May 11 '16 at 21:01

The option you are looking for is not AllowTunnel (it is for VPN and level 3 forwarding using tun devices). You are looking for AllowTcpForwarding, which handles local and remote port forwarding of TCP traffic in ssh.

Have a look what values is in your server and change it to yes:

AllowTcpForwarding yes
  • Thanks for your quick answer. That seems to have fixed my issue. I had seen others with the same issue and one suggestion was AllowTunnel yes in sshd_config, but that did not work for me. Dec 6 '15 at 21:45
  • 1
    It is probably some urban legend, as also the other answer came here. No idea where did it come from and it is so easy to open manual page and check the meaning. If it works for you, have a second to check the answer as solution to help others.
    – Jakuje
    Dec 6 '15 at 21:48
  • 1
    Why the down-vote?
    – Jakuje
    Nov 7 '16 at 22:04
  • AllowTcpForwarding Specifies whether TCP forwarding is permitted. The available options are “yes” or “all” to allow TCP forwarding, “no” to prevent all TCP forwarding, “local” to allow local (from the perspective of ssh(1)) forwarding only or “remote” to allow remote forwarding only. The default is “yes”.
    – Bart Polot
    Dec 31 '17 at 20:06
  • related (false): serverfault.com/a/24389/328011
    – YSC
    Aug 27 '19 at 11:44

I had a name resolution cause for this error. My /etc/hosts had an erroneous IP address for the name of the server (not for localhost), like this:     localhost  server.domain.com server

But the configured server IP (and the DNS name resolved with the host/dig commands) was A simple typo caused by a previous IP reconfiguration. After fixing /etc/hosts the tunnel connection worked flawlessly:

ssh user@server.domain.com -L 3456:

It is weird that the real IP caused the failure when I was using the localhost literal IP for the tunnel. Distro: Ubuntu 16.04 LTS.

Not the answer you're looking for? Browse other questions tagged or ask your own question.