Refused local port forward

[leonardorame]

Hi, need to access the web ui of a FreeNas server from home (server is very far away), but sadly I only forwarded the SSH port on the site's router.



I can connect to the SSH console of the server, but when I create a tunnel using

Code:

ssh -L 8080:127.0.0.1:80 myuser@host.ip.add.ress

and then try to connect from my browser pointing to http://127.0.0.1:8080 on the ssh console I get:

Code:

channel 4: open failed: administratively prohibited: open failed

channel 4: open failed: administratively prohibited: open failed

channel 4: open failed: administratively prohibited: open failed

channel 4: open failed: administratively prohibited: open failed

channel 4: open failed: administratively prohibited: open failed

channel 4: open failed: administratively prohibited: open failed

If I take a look at /var/log/auth.sh I have:

Code:

Jun 30 06:49:57 freenas sshd[4114]: refused local port forward: originator 192.168.0.109 port 54428, target 127.0.0.1 port 80

Jun 30 06:49:57 freenas sshd[4114]: refused local port forward: originator 192.168.0.109 port 54430, target 127.0.0.1 port 80

Jun 30 06:49:57 freenas sshd[4114]: refused local port forward: originator 192.168.0.109 port 54432, target 127.0.0.1 port 80

Here's my /conf/base/etc/ssh/sshd_config:

Code:

#	$OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

#	$FreeBSD: src/crypto/openssh/sshd_config,v 1.48 2008/08/01 02:48:36 des Exp $



# This is the sshd server system-wide configuration file.  See

# sshd_config(5) for more information.



# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin



# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.  Uncommented options change a

# default value.



# Note that some of FreeBSD's defaults differ from OpenBSD's, and

# FreeBSD has a few additional options.



#VersionAddendum FreeBSD-20080801



#Port 22

#Protocol 2

#AddressFamily any

ListenAddress 0.0.0.0

#ListenAddress ::



# Disable legacy (protocol version 1) support in the server for new

# installations. In future the default will change to require explicit

# activation of protocol 1

Protocol 2



# HostKey for protocol version 1

#HostKey /etc/ssh/ssh_host_key

# HostKeys for protocol version 2

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_dsa_key



# Lifetime and size of ephemeral version 1 server key

#KeyRegenerationInterval 1h

#ServerKeyBits 1024



# Logging

# obsoletes QuietMode and FascistLogging

#SyslogFacility AUTH

#LogLevel INFO



# Authentication:



#LoginGraceTime 2m

PermitRootLogin yes

#StrictModes yes

#MaxAuthTries 6

#MaxSessions 10



#RSAAuthentication yes

#PubkeyAuthentication yes

#AuthorizedKeysFile	.ssh/authorized_keys



# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

#RhostsRSAAuthentication no

# similar for protocol version 2

#HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# RhostsRSAAuthentication and HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

#IgnoreRhosts yes



# Change to yes to enable built-in password authentication.

PasswordAuthentication yes

PermitEmptyPasswords yes



# Change to no to disable PAM authentication

ChallengeResponseAuthentication no



# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no



# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes



# Set this to 'no' to disable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication.  Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

#UsePAM yes



#AllowAgentForwarding yes

AllowTcpForwarding yes

#GatewayPorts no

#X11Forwarding yes

#X11DisplayOffset 10

#X11UseLocalhost yes

#PrintMotd yes

#PrintLastLog yes

#TCPKeepAlive yes

#UseLogin no

#UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#UseDNS yes

#PidFile /var/run/sshd.pid

#MaxStartups 10

PermitTunnel yes

#ChrootDirectory none



# no default banner path

#Banner none



# override default of no subsystems

Subsystem	sftp	/usr/libexec/sftp-server



# Example of overriding settings on a per-user basis

#Match User anoncvs

#	X11Forwarding no

#	AllowTcpForwarding no

#	ForceCommand cvs server

As you can see I have AllowTcpForwarding set to "yes".



Can anyone help me solve this?.



Leonardo.

 

[Chris Moore]

Why would you try to use the loop back address?

Sent from my SAMSUNG-SGH-I537 using Tapatalk

 

[leonardorame]

Well, I usually use that, but I've also tried with the hostname and the ipv4 address with the same result.

 

[leonardorame]

Let me clarify, the command ssh -L 8080:127.0.0.1:80 myuser@host.IP.add.ress is issued on my client machine.

 

[danb35]

There's a FreeNAS setting for this:

I'm not aware of any practical way to change that at the command line without using the API.