In v3.27 is not working ssh port forwarding functionality (or not allowed in ssh service), experienced on RB433AH. By ssh port forwarding I mean tunneling TCP connection trough SSH session to Mikrotik router. For example (in terminal on Linux desktop): After that trying winbox on localhost:8291 will not work and on ssh console is printed "channel 3: open failed: administratively prohibited: bla bla".
Similar with Ssh port forwarding is working in v3.22 and previous versions (did not try version between v3.22-v3.27). CHANGELOG_3 does not show any record about changing this feature -> looks like a bug.

I'm experiencing same problem in 3.27 and 3.26. It works in 3.25 and older versions.
This feature is great to fast access remote network devices behind nat without classic port forwarding. I used this feature with ssh client putty. There is item Connection-SSH-Tunnels in menu of putty which is not working now.
Thank you for repairing in comming version of RoS.

...because you bastards won't give it to us!

From personal experience (IPv6 over PPPoE), I know how frustrating it is when features you rely on are removed with no notice and no apology, however, there is no justification for abuse at all - it doesn't help things, it just upsets the people who you really don't want to upset. What happens the next time you have a query? Why should they bother replying to somebody who abuses them? As I have found with the IPv6/PPPoE issue, Mikrotik simply ignore any topics in which they have been (mildly in this case) abused.

That having been said, Mikrotik's release notes leave a lot to be desired and there really should have been some mention of changes to the SSH subsystem (if, indeed, there was one) and the reason for these changes.

I also agree that it can be frustrating that older versions of the software are not available. I strongly suspect that Mikrotik would supply any older version if you didn't have it yourself, however having all versions on-line would be a nicer way of doing things. as the number of RBs we have increases, I think I will start archiving all the firmware (in all versions) just in case. It would have been sensible of me to have started doing this a long time ago.

I never knew RouterOS had such ability. I will check what went wrong.

Nick, over 50% of all technical support email question are fixed by simple upgrade. If people would just use the latest version, we would solve a lot of delays in email responses. In new versions there are certainly more fixes than issues. It's obvious that new versions are released to improve older ones, and if people don't use them, we can't fix their issues. This is why we don't advertise any old version archive, and this is why we have one older version listed (v3.13) so you have a fallback possibility in case of a sudden problem.

Nick, over 50% of all technical support email question are fixed by simple upgrade. If people would just use the latest version, we would solve a lot of delays in email responses.

That may well be the case, but it wasn't the point I was making.

I am surprised at your response though - I was trying to offer a measured post in response to the OP's abusive language and tone which I found offensive and quite unnecessary.

However, I am puzzled why you suggest that everybody should be using the latest version when some features (e.g. IPv6/PPPoE) have been removed, forcing users to stay with older firmware versions. Unfortunately, the problems with the latest 3.x releases have certainly caused me to be more reluctant to immediately upgrade all our RBs as I simply don't know what will work and what won't any more.

Given the recent problems, I don't think it is unreasonable to expect users to hang back one or two releases from the latest version just in case.

again - just so everyone knows, ipv6 over pppoe was NOT a feature. It just so happened it worked. It was not something they added on purpose. It broke encryption on certain PPP tunnels > 1280 MTU and so they disabled it. You could be running a tunnel unencrypted without knowing it. I would rather they have fixed the PPP code and not just disabled ipv6 over tunnels, but they must have their reasons.

Anyone else that needs ipv6 over a tunnel (l2tp, pptp, ipip, pppoe, etc) please just post to the original thread and ask for it to be fixed.

Normis, yes, RouterOS would do ssh tunneling probably because its just built into the ssh daemon. Sometimes a handy feature to have for a simple winbox or ssh redirect.

again - just so everyone knows, ipv6 over pppoe was NOT a feature. It just so happened it worked.

Understood, but given that other products support IPv6/PPPoE, that there is at least one RFC stating how it should work and that it did work (your point on encryption is also understood), I think it is fair to assume that it was a feature of RouterOS. Simply removing it and then writing everything which was said in the thread (I'll not rehash it here) was, in my opinion, out of order.

To be clear, I understand why IPv6/PPPoE was disabled, I just don't happen to agree with the reasons, nor with the opinion that I shouldn't have been using it in the first place.

Anyway, that's the last from me on IPv6/PPPoE in this thread. I didn't want to discuss it here and was just using it as an example to try to persuade the OP to curb his abuse a little.

Same problem here on 3.27.
This feature is very useful for us, and we are using it every day.

We hope to see it working again in the next release.

Regards,

This feature was disabled because it posed a security risk to those, who didn't know about it. We are making a new SSH package right now, where this feature will be integrated, and will be configurable (ie. you will be able to turn it on if you want).

A security risk? It is a feature that does not work unless you are actually connected to the router using SSH, which means you already authenticated.

Anyway, if you want to be paranoid about security, make it disabled by default, but configurable.

SSH port forwarding is THE swiss-army-knife of network admin, and having that in mikrotik has been the reason to replace lots of routers with mikrotik hardware.

On the other hand, this brings up the issue of "ChangeLog" being quite bogus, as a modification in the configuration of sshd (or dropbear) should be announced there.

Cheers,
///Pablo

Anyway, if you want to be paranoid about security, make it disabled by default, but configurable.

We are making a new SSH package right now, where this feature will be integrated, and will be configurable (ie. you will be able to turn it on if you want).

I use this between linux hosts for secure remote database access. (Lets a local database client access a remote database as if it were local)

Never thought to use it with Mikrotiks for the purposes described, but it could indeed be handy!

I could concur this sort of change should be in the changelog if it was an intentional change.

[quote="normis"]This feature was disabled because it posed a security risk to those, who didn't know about it. We are making a new SSH package right now, where this feature will be integrated, and will be configurable (ie. you will be able to turn it on if you want).[/quote]

I checked v3.30, problem still remain. I did search for any configuration option ("ip service set ssh .." and "user ssh-keys set ..") unsuccessfully.

Normis, can you tell us more about planed SSH package (when, how configure ...). Thank you.

any progress with that issue?

The 4.0 release from today still doesn't permit port forwarding:

Mikrotik replied in a email about this issue:

Hello,
that feature wont be added back as it is grate security risk to your network.
Instead you should create dst-nat rules to forward ports and then you will be
aware that nat for that prot+host exists and you have to secure it. That Also
gives more power to create different policies using firewall filter, and thus,
results in more secure and safe network.

I would say it's more secure than port forwarding+firewalling as MT suggest as an alternative.

First, we use firewall with ssh, (which I think should default with MT), so I can compare SSH with port forwarding+firewalling with respect to security.

Essentially, the goal could be done with either SSH or port forwarding. The SSH is authenticated with an ssh key, which is a very secure method of connecting. Port forwarding, no authentication.

If SSH isn't safe in MT, it should be made so, and the tool for doing that is the firewall. OpenSSH has a LOOOONNNNNGGG history of security problems, and I've been adminning through most of it, so I have always kept SSH firewalled so that our servers are protected from ssh probing. It has been much better in the past couple years, but I feel better about people not probing my ssh. You see it all the time on MT if you don't control access to ssh with firewall. It will fill up your logs.

Since newbies will use winbox most likely to access the router they'd be unaffected, something like this would go a long way to make MT more secure out of the box.

Mikrotik replied in a email about this issue:

omg... who's author? O_o

Hello,
that feature wont be added back as it is grate security risk to your network.
Instead you should create dst-nat rules to forward ports and then you will be
aware that nat for that prot+host exists and you have to secure it. That Also
gives more power to create different policies using firewall filter, and thus,
results in more secure and safe network.

Dear Mikrotik,

As your humble user, I'd like to take liberty to remind You a very well known quote: Guns don't kill people, people kill people - ssh port forwaring is no to be blamed, but unqualified admins. Like we don't switch off php in apache if there is some unescaped sql queries which drop your databases? or do you?

This feature was disabled because it posed a security risk to those, who didn't know about it. We are making a new SSH package right now, where this feature will be integrated, and will be configurable (ie. you will be able to turn it on if you want).

That would be fine, disabled for unaware, enableable for ones who need it.

Mikrotik replied in a email about this issue:

omg... who's author? O_o

Think what you want I suppose. Fact is, it's not going to be added back in.

I don't know who wrote this, but it's not true. It's a security risk only if you don't know that this feature exists (it wasn't documented and configurable). We are working on a new SSH package that will have this feature, you will be able to turn it on if you need it.

Normis, you guys apparently need to communicate more

I removed your posted mails, I have talked to Janis K, he was misinformed.

I removed your posted mails, I have talked to Janis K, he was misinformed.

So SSH port forwarding is planned to be added back in a future version of RouterOS? I wasn't wrong then, I was simply posting exactly what I was told from a Mikrotik support person.

I know, that's what I said. I just confirmed that it's still in the "feature request" list and will be made.

Ouch! This is the first I heard of this...explains why I couldn't dial in through my SSH tunnel to my desktop while I was away this weekend. You've got my vote to add it back in asap. This is a very valuable feature! I use it alot to tunnel to my home PC from remote and for work at our mikrotik-enabled hot spots. It is also valuable to reach equipment behind a NAT that doesn't have a default gateway configured on it (this is for equipment that we did not install, but took over the management of it). In that situation dst-nat won't work. SSH tunnel is the only way.

Is there an estimated date for a fix?

It is also valuable to reach equipment behind a NAT that doesn't have a default gateway configured on it (this is for equipment that we did not install, but took over the management of it). In that situation dst-nat won't work. SSH tunnel is the only way.

in that case, you need src-nat, not dst

Just wanted to update for completeness:

In RouterOS v4.2 x86: Hopefully will be brought back in v4.3.

Mikrotik any plans? Since it was in a previous version, it's kindof important to get it back I think, since it's not a "new" feature.

+1 for port forwarding.
when you are using for egz campus network when almost everything is blocked, besides the standard 80 port and SSH for outgoing connections.

the only way to administer your network is to tunel OpenVPN over SSH. then you gain access to unlimited internet and/or local resources wherever you are.

I was also dissapointed when i found out about that, after i upgraded, but it's not first time MT has done something like this.

My wish is that MT will take more care about changelog.

And i also hope you will release ssh package for 3.30 as i want back my functionality without need to buy new license.

B/R
Michal

And i also hope you will release ssh package for 3.30 as i want back my functionality without need to buy new license.

btw, upgrade to v4 is free for any v3 owners

Thanks, MikroTik, for responding to customer requests to add SSH port forwarding back! I look forward to it greatly! (I use it a LOT.)

Aaron out.

What I wrote before still stands:

It's a security risk only if you don't know that this feature exists (it wasn't documented and configurable). We are working on a new SSH package that will have this feature, you will be able to turn it on if you need it.

normis: I must not have been clear. I was thanking MikroTik, and indirectly YOU specifically, for responding so very well to users' needs. We appreciate it!

Aaron out.

Hi There,

I'd like to tell you I spent a lot of time finding out why SSH tunneling doesnt work anymore... I thought, there is some kind of problem with firewall rules... Then, I found this forum topic...otherwise I would thought there are some ghosts in there.

Why Mikrotik doesnt include important information like this into the changelog? I woudnt upgrade to this version if I knew that...

Please, could you help me with downgrading mikrotik to previous version which supports SSH tunneling(ssh port forwarding)... I can't find any previous package... I need one for for RB333...and I will probably need a lot of others for different RBs.. Could you tell me please where I can download it? What is the best way to downgrade and having the same configuration?

Even that I'd like to thank a lot to Mikrotik for good work they do and to all users of this forum as their comments that helped me many times before, even thought this comment is my first.

Thanks a lot
Kind regards
Jendik

It wasn't supposed to work before, this was not a feature. It was a bug.

I can confirm that the new SSH package already includes SSH forwarding option. Release date unknown.

...almost all Vendors say the sentence about bug and feature in the opossite way-)...

Could you help me please, finding previous bug versions? I really need this bug for lot of our routers... Any suggestions for downgrading please?

Thank you
J.

You will have to wait until we release a new version. that bug is a security risk because it can't be configured or controlled.

...almost all Vendors say the sentence about bug and feature in the opossite way-)...

Could you help me please, finding previous bug versions? I really need this bug for lot of our routers... Any suggestions for downgrading please?

Thank you
J.

Hats off to you, I've never ever heard this before! People actually wanting "bugs", lol, Mikrotik, market things a bit better. You probably didn't invent the SSH package, and just about every single install of SSH on any server in the world supports tunneling. Given that, I don't think it's appropriate to call it a bug. Think of all the hard work the ssh team spent trying to implement ssh tunneling that is so widely used today, just for another company to call it a bug.

Anyway, I got a good laugh out this one

yea, it's the first time when I say it's a "feature" and Vendor says it's a "bug"-))
anyway... I need this bug/feature or whatever You call it back...

please, is there anybody, who could tell me, where I can download version 3.24 and the right way how to downgrade???

please..

thanks a lot!
J.

please, is there anybody, who could tell me, where I can download version 3.24 and the right way how to downgrade???

http://66.228.113.58/all_packages-mipsbe-3.24.zip

Copy to 'files' then under 'system, packages' hit the downgrade button. Should work.

hey all,

waiting for ssh forwarding to come... really need this to access ssh on another device in LAN from outside.
maybe in 4.4 ?

works in 4.4

just works? without additional settings? %)

but it's insecure - why it wasn't mentioned in changelog?..

hi,
yeah just works.. i haven´t seen any settings for this. but it works.

On an RB750G running 4.4 it does NOT work, or there IS a security setting somewhere to enable it that I haven't yet found. It fails with: "channel 3: open failed: administratively prohibited: bla bla"

Or that's a firewall rule of mine... (*quickly begins checking for blocked packets*) No, no dropped packets... (*double-checks the SSH connection to be sure the remote host is accepting connections*)

This has got to just be a firewall issue on my side if port forwarding is working for others on 4.4, esp. since that message is an OpenSSH error whenever it fails to connect to the forwarded site... Hmmm...

Aaron out.

Tried it on another device (RB411) running 4.4 that does bridging with absolutely NO IP filters, no bridge filters, etc. with the same result. And I verified connectivity from the RB411 to the IP and port in question (/system telnet W.X.Y.Z 1234) to be sure that a forwarded connection SHOULD be able to connect. No go: "channel 2: open failed: administratively prohibited: bla bla"

Exploring around, I can't find a setting to tweak. So either SSH port forwarding in 4.4 remains disabled, or there IS a setting I haven't found.

Aaron out.

the new SSH package is not yet released. Not sure why and how it works for some of you, we will check.

please, is there anybody, who could tell me, where I can download version 3.24 and the right way how to downgrade???

http://66.228.113.58/all_packages-mipsbe-3.24.zip

Copy to 'files' then under 'system, packages' hit the downgrade button. Should work.

THanks a lot!!! I downloaded PPC package as well-)

take care
j.

the new SSH package is not yet released. Not sure why and how it works for some of you, we will check.

i just left the filter / nat rules as they were before upgrade...
before the upgrade they doesnt work. but after upgrading to 4.4 they re working.
this really helps me because i need to arrive a debian server behind my rb450g via ssh.

but i think it depends on the update

Quick and dirty way around this.

If your board supports metarouter with openwrt images, install one (do a search on the forums for openwrt) and then you can SSH tunnel through the OpenWRT image instead of RouterOS. Worked for me in testing. The only down side to this is that the Metarouter fans (myself included) are waiting on a fix to a bug that causes watchdog to reboot the box about every 20 minutes to couple hours. However, if the metarouter is disabled when you don't need it this bug should not present itself.

Still looking forward to this feature being re-enabled.

In v3.27 is not working ssh port forwarding functionality (or not allowed in ssh service), experienced on RB433AH. By ssh port forwarding I mean tunneling TCP connection trough SSH session to Mikrotik router. For example (in terminal on Linux desktop):

Code: Select all

ssh -L 8291:localhost:8291 admin@my-mikrotik;

After that trying winbox on localhost:8291 will not work and on ssh console is printed "channel 3: open failed: administratively prohibited: bla bla".
Similar with

Code: Select all

ssh -L 2222:OtherMikrotik:22 admin@my-mikrotik;

Ssh port forwarding is working in v3.22 and previous versions (did not try version between v3.22-v3.27). CHANGELOG_3 does not show any record about changing this feature -> looks like a bug.

Hi Mikrotik staff, any news?

I some routers running ROS 4.4 and receive "channel 2: open failed: administratively prohibited: bla bla" trying winbox via SSH tunnels.
Routers running 3.20 work fine...

"bla bla" eats my brain %)

"bla bla" eats my brain %)

This is the exact RouterOS error message!!!

I know, that's why it does

any update on ssh tunnels being made available ?

Anybody has any idea if newer versions of RouterOS have the SSH port forwarding functionality back in place?

It is march 2010 and still no official --or unofficial, for that matter-- stance about this.

I guess Mikrotik engineering staff does not really do any real admin work on live networks.

On the other hand, taking more than a year to fix an issue that was stubbornly introduced
by lack of knowledge is unacceptable. Come on! It is just changing a #define in a .config file.

I hope there is no "ip packet forwarding failed: administratively prohibited: wee wee" message in a later version.
After all, moving packets between networks could lead to a security issue.

Anybody has any idea if newer versions of RouterOS have the SSH port forwarding functionality back in place?

It looks like not. Latest version is 4.6, but we don't have it installed anywhere. I tested it on 4.5 - not working. I tried to find any "config option" for switch on of "ssh port forwarding funcionality" (as some people from Mikrotik mentioned above), unsuccessful. Changelog does not have any info about it (unfortunately, they do not write there this type of regression/fix).

I guess Mikrotik engineering staff does not really do any real admin work on live networks.

Have same feeling.

RouterOS v5 will have this possibility back

It is march 2010 and still no official --or unofficial, for that matter-- stance about this.

you need to follow up on MikroTik's announcements

http://www.tiktube.com/?video=337

From reading these posts it seems that the versions newer than 3.27 won't allow forwarding of ssh on port 22 to an inside host. I am having trouble trying to do just that. It may be something that I am not getting right. I can post specifics, but would like to know if it is still possible.

From reading these posts it seems that the versions newer than 3.27 won't allow forwarding of ssh on port 22 to an inside host. I am having trouble trying to do just that. It may be something that I am not getting right. I can post specifics, but would like to know if it is still possible. :?

If you're using a RouterOS version between 3.27 and 5beta you cannot do SSH port forwarding.

Is 5beta ready? I don't see it in the download area.

No, it apparently is in pre-release: http://forum.mikrotik.com/viewtopic.php?f=1&t=39974

You definitely shouldn't be using it on production gear yet.

@Mikrotik
Can't you guys just issue a patch with ssh fixes?
Not having SSH tunneling capability for so long is really a problem

v5 beta works with ssh forwarding. I still can't run commands remotely from the RouterOS ssh client. This would be really handy. Also, I'd like to login using DSA keys from the RouterOS ssh client as well.

in 5.0beta whole ssh thing is rewritten from ground up. Newer builds of it now work properly for remote commands.

Is beta stable enough to use in production (just a small LAN) ?

at least, wait for public beta release =) for now, it's something like alpha

janisk,

I was referring to the the ssh client on the RouterOS itself.

Something like this: This if more of a feature request though, I don't mean to steer off topic.
For reference, I never had any issue with remote command execution from ssh to RouterOS, only port forwarding.
I was specifically talking about command execution from within RouterOS's ssh client itself to another ssh server.

v4.8 - and it's still not there, sigh...

it is there in v5

v4.8 - and it's still not there, sigh...

new features go into v5 beta, don't expect it in v4.

Thanks to all developers of mikrotik, it works in RoS 5. Good work

v4.8 - and it's still not there, sigh...

new features go into v5 beta, don't expect it in v4.

except it isn't a new feature, it is a regression that is fixed as the feature existed in version prior to 3.27.

it's not, and it was said earlier =)

Dear developers,

I appreciate the work you are doing and you've created a nice brand. But with things like this you're killing it.. I had to downgrade my router version today and that sucks. I understand you want to have better product, but I want my functionality I paid for. Come on guys this thread is 1,5 year old, what's so complicated on old good ssh forwarding to fix it that long? Besides it wasn't broken at all, it is a matter you see things. Dnat to somebody's network isn't much better idea.

Yours faithfully