How to fix open failed: administratively prohibited: open failed in SSH

Connect to the SSH server and inspect the current sshd_config settings:

sudo grep -E 'AllowTcpForwarding|PermitTunnel|DisableForwarding' /etc/ssh/sshd_config

If these lines are absent, the defaults apply (which may be 'no' on hardened systems). Note the current values before making changes.

Edit /etc/ssh/sshd_config and add or modify the AllowTcpForwarding setting:

sudo nano /etc/ssh/sshd_config

Find or add this line:

AllowTcpForwarding yes

This enables both local (-L) and remote (-R) port forwarding. Save and exit (Ctrl+X, then Y, then Enter in nano).

If you need tun/tap device tunneling (not just port forwarding), also add:

PermitTunnel yes

This enables VPN-style connections using device forwarding. If you only need port forwarding, this is optional.

Inspect the file for Match blocks that might override global settings:

sudo grep -n 'Match' /etc/ssh/sshd_config

Look for blocks like:

Match User someuser
    DisableForwarding yes

If Match blocks disable forwarding for your user, either remove those lines or add your user/group to a block that allows forwarding.

Apply the configuration changes by restarting sshd:

sudo systemctl restart sshd

On BSD systems, use:

sudo service sshd restart

Or on older systems:

sudo /etc/init.d/sshd restart

Verify the fix by attempting a port forward operation:

ssh -v -L 9999:127.0.0.1:3306 user@remotehost

The -v flag adds verbose output. You should see successful channel open messages instead of 'administratively prohibited'. For tunnels, leave the connection open and test from another terminal.