I would like to connect 2 tap-devices. The tap-device on the remote server is owned by "user". This is my test-command:

# ssh -oTunnel=ethernet -w0:0 user@server

But it does not work, I get this error:

channel 0: open failed: administratively prohibited: open failed

On the server, the tap-devices are created by some mechanism of opensuse. The configuration files are /etc/sysconfig/network/ifcfg-tap[0-2]:


and /etc/sysconfig/network/ifcfg-br0:

BRIDGE_PORTS='tap0 tap1 tap2'

How could I solve this problem?

  • 1
    Hi. What distro and location? – Time4Tea Jan 18 '19 at 11:01
  • I am little confused. I was about to answer "not" because I remember it once said in the man page that you require root privileges on your client to create a tun or tap device, but I cant find that remark i neither ssh nor ssh_config man pages. So I guess I don't have an answer for you. :-( – Bananguin Jan 18 '19 at 12:34
  • 1
    The tap already exists and is owned by the user. ssh just has to attach to it. As root, there is no problem, but I prefer to use a normal user. – Peter Jan 18 '19 at 12:44
  • As you say, the easiest way is doing as root on both sides. I also do not feel confy doing it. – Rui F Ribeiro Jan 18 '19 at 13:46
  • @A.B: of course, PermitTunnel = yes. There does not seem to be SELinux/Apparmor on the server. There is no such problem with qemu, that can attach to tap devices without problems here... So I guess, that the problem is specific to sshd. – Peter Jan 18 '19 at 15:25

I don't know why, but this works (thanks to A.B):

1.) remove the relevant files in /etc/sysconfig/network

2.) systemctl restart network

3.) create the same setup with the "ip" tool:

ip tuntap add tap0 mode tap user user
ip tuntap add tap1 mode tap user user
ip tuntap add tap2 mode tap user user
ip link add name br0 type bridge
ip link set tap0 master br0
ip link set tap1 master br0
ip link set tap2 master br0
ip addr add dev br0
ip link set br0 up
ip link set tap0 up
ip link set tap1 up
ip link set tap2 up

Of course, this is only a workaround. A better answer would be, that still uses the openSUSE provided mechanism.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.