Re: channel 3: open failed: connect failed: Connection refused

per@xxxxxxxxxxxx (Per Hedeland) writes:
In article <m2ir3sodwk.fsf@xxxxxxxxxxxxxxxxx> blueman
<NOSPAM@xxxxxxxxxx> writes:
I have done a lot of googling and have not been able to figure out
what the above error message means.

My specific situation is as follows:
Case 1: ssh from linux box to linux box
Screen1: Client> ssh Server -L 9546:127.0.0.1:9546

Screen2: Client> telnet 127.0.0.1 9546

Then on Screen1 (which is now ssh'd into the Server, I see the
following message:
channel 3: open failed: connect failed: Connection refused

There is nothing actually running on port 9546 of the
Server.

Which is exactly what the message is telling you. Your instructions to
ssh/sshd are: When I connect to the local port 9546, forward that
connection to the server and connect to port 9546 there. When you
actually do the connect, you are duly informed that the remote
connection failed because nothing was listening on that port on the
server. You can try e.g. 'telnet localhost 12345', i.e. connect to a
*local* port where nothing is listening - it will give the same
"Connection refused".


OK. Well, let me explain what I am doing in more detail and maybe
someone can explain what is going wrong.

I am trying to tunnel smb (cifs) over ssh by redireting port 445 over
a non-priveleged port on both ends. On the client end, the command
mount.cifs allows you to specify an arbitrary port and on the server
end I am using iptables to route from the ssh-forwarded non-privileged
port back to port 445 where smbd (the samba server) listens.

Specifically,
1. On the ssh and smb server I am using the "PREROUTING" iptable to
re-route incoming traffice from a non-privileged port (say 1445) to
445, using the following rule:

-A PREROUTING -p tcp --dport 1445 -j DNAT --to 127.0.0.1:445

(My intention is that this should effectively "trick" the smbd
server that it is listening in also on port 1445)

2. On the ssh client, I do the following 2 things:
a] First, tunnel port 1445, using:
ssh servermachine -L 1445:127.0.0.1:1445

b] Use mount.cifs over port 1445 to route the smb mount command to
localhost on port 1445

mount.cifs //127.0.0.1/myshare /mnt/mymount -o username=myname,ip=127.0.0.1,port=1445


I would think that I would have implemented this tunnel:

SMB mount command
-> Client machine 127.0.0.1:1445
-> Server machine 127.0.0.1:1445
-> Server machine 127.0.0.1:445

When I try to mount the share remotely as above, I get the response:
channel 3: open failed: connect failed: Connection refused
which you explained as meaning that nothing is presumably listening in
on 127.0.0.1:1445

However, it does work if I run the mount command locally on the server
which would seem to indicate that the iptables redirect is working and
that smbd is indeed effectively listening in on 127.0.0.1:1445

So, I guess I'm stuck and not sure why things aren't working here...
.

Relevant Pages

  • Re: ipfw and nmap
    ... > even be correct but I have a bsd box that is simply providing me SSH ... add allow tcp from any to me 22 setup in via fxp0 keep-state ... Note too that there is nothing to prevent port scanners simply setting ... the 'SYN' flag in the probe packets they send to your server. ...
    (freebsd-questions)
  • Re: RealVNC
    ... Default listening port for RealVNC server that runs on the machine on which ... Then there is default Java listening port on port 5800 on the client machine ...
    (microsoft.public.windows.server.sbs)
  • Re: Remote Desktop directly to another computer on the network
    ... default port... ... And there is no reason for me to believe that ssh ... When I have a multibillion company I will use the key pair, ... WinSCP for that to access my home SSH server. ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: need help for setting SSH Server for Windows XP
    ... In my windows firewall proper ports are opened. ... Changing from port 22 to ports 80, 443 also doesn't give any results. ... static LAN IP of the server PC. ... It is *NOT* a valid test to call the SSH server PC from another ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: Port Forwarding -- Checking to be sure I understand it
    ... They run an ssh ... server and VNC service. ... If you want to run the tunnel over some port other than 22 (the ... restrictive firewalls that deny all incoming connections and block most ...
    (comp.security.ssh)