How do I forward all requests from local port to port on my remote Amazon EC2 instance which is using a custom ssh port

Question

I am trying to forward all requests from local port 8888 to port 8888 to my remote Amazon EC2 instance. The only difference is that my EC2 instance is running ssh on custom port 56129.

I can successfully ping my ec2 instance from the local system but when I try to forward requests from a local port to a port on ec2 instance, I am getting:

channel 2: open failed: administratively prohibited: open failed

I am using the following command:

ssh -i <pem key> -NfL 8888:localhost:8888 <user>@<instance ip> -p 56129

Then it asks for a password. There are no messages when it accepts the password. But as soon as I open localhost:8888 in my browser, I get the error message:

channel 2: open failed: administratively prohibited: open failed

Some observations -

• Running ssh -i <pem key> <user>@<instance ip> -p 56129 with a password is successful.

• I am running Jupyter Notebook at port 8888 in EC2 instance. curl localhost:8888 returns nothing when done after ssh-ing into the instance

Answer 1

I think you need to bind the local address to achieve what you want:

ssh -i <pem key> -NfL localhost:8888:localhost:8888 <user>@<instance ip> -p 56129

or

ssh -i <pem key> -NfL localhost:8888:<instanceip>:56129 <user>@<instance ip>

As it's not 100% clear what you want to achieve.

Test with

telnet ipaddress portnumber

Which gives you a connect (or not) in advance and when running it to check.

Answer 2

The message tells the (remote) sshd server settings doesn't allow to forward TCP ports.

This option should be enabled on the remote sshd server's configuration (usually in /etc/ssh/sshd_config):

AllowTcpForwarding

Specifies whether TCP forwarding is permitted. The available options are yes (the default) or all to allow TCP forwarding, no to prevent all TCP forwarding, local to allow local (from the perspective of ssh(1)) forwarding only or remote to allow remote forwarding only. Note that disabling TCP forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders.

The default above is for a Debian system and might not be the default on AWS' sshd. This option has to be set in /etc/ssh/sshd_config as yes/all or at least local to enable the port forwarding:

AllowTcpForwarding yes

and the remote sshd server should be reloaded or restarted for the option to take effect on new connections. Be careful, any syntax error might prevent further access if not quickly corrected on a connection still in use.

There are many other subtleties related to enabling port forwarding. For example a dedicated entry in user's authorized_keys could restrict it to specific ports only (as long as the system-wide configuration still allows it).