I am trying to forward all requests from local port 8888 to port 8888 to my remote Amazon EC2 instance. The only difference is that my EC2 instance is running ssh on custom port 56129.

I can successfully ping my ec2 instance from the local system but when I try to forward requests from a local port to a port on ec2 instance, I am getting:

channel 2: open failed: administratively prohibited: open failed

I am using the following command:

ssh -i <pem key> -NfL 8888:localhost:8888 <user>@<instance ip> -p 56129

Then it asks for a password. There are no messages when it accepts the password. But as soon as I open localhost:8888 in my browser, I get the error message:

channel 2: open failed: administratively prohibited: open failed

Some observations -

  • Running ssh -i <pem key> <user>@<instance ip> -p 56129 with a password is successful.

  • I am running Jupyter Notebook at port 8888 in EC2 instance. curl localhost:8888 returns nothing when done after ssh-ing into the instance

  • the message tells "channel 2: administratively prohibited: open failed" and not "channel 2: open failed: connect failed: Connection refused". That means the remote sshd server doesn't allow this in its settings. Look at the remote sshd configuration and logs.
    – A.B
    Commented Feb 20, 2022 at 16:14
  • What would you like me to see?
    – kusur
    Commented Feb 20, 2022 at 16:28
  • 1
    I wrote an answer
    – A.B
    Commented Feb 20, 2022 at 16:29

2 Answers 2


I think you need to bind the local address to achieve what you want:

ssh -i <pem key> -NfL localhost:8888:localhost:8888 <user>@<instance ip> -p 56129


ssh -i <pem key> -NfL localhost:8888:<instanceip>:56129 <user>@<instance ip>

As it's not 100% clear what you want to achieve.

Test with

telnet ipaddress portnumber

Which gives you a connect (or not) in advance and when running it to check.

  • I am trying to connect to the application running in the remote server from my local system. Does this help you?
    – kusur
    Commented Feb 20, 2022 at 16:10
  • The second option isn't making sense. Application is running on port 8888 in the remote server. Why would I want to connect to 56129 port?
    – kusur
    Commented Feb 20, 2022 at 16:11

The message tells the (remote) sshd server settings doesn't allow to forward TCP ports.

This option should be enabled on the remote sshd server's configuration (usually in /etc/ssh/sshd_config):


Specifies whether TCP forwarding is permitted. The available options are yes (the default) or all to allow TCP forwarding, no to prevent all TCP forwarding, local to allow local (from the perspective of ssh(1)) forwarding only or remote to allow remote forwarding only. Note that disabling TCP forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders.

The default above is for a Debian system and might not be the default on AWS' sshd. This option has to be set in /etc/ssh/sshd_config as yes/all or at least local to enable the port forwarding:

AllowTcpForwarding yes

and the remote sshd server should be reloaded or restarted for the option to take effect on new connections. Be careful, any syntax error might prevent further access if not quickly corrected on a connection still in use.

There are many other subtleties related to enabling port forwarding. For example a dedicated entry in user's authorized_keys could restrict it to specific ports only (as long as the system-wide configuration still allows it).

  • I get ssh: Could not resolve hostname 8888:localhost:8888: Name or service not known when I set AllowTcpForwarding to yes or comment it out
    – kusur
    Commented Feb 20, 2022 at 16:33
  • You'll have to give again the exact command that was used: probably a typo. It doesn't look like the previous command done in your question.
    – A.B
    Commented Feb 20, 2022 at 16:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .