So I am relatively new to the networking aspects of AWS and am having a problem. Here is a short description of what I have.

I have a RDS that is not publicly accessible. The endpoint resolves to a private 10.X.X.X IP. I have an EC2 instance that is in the same VPC/subnet and is publicly accessible. I can SSH to this EC2 instance with no problems. Oddly, I have a process running on that EC2 instance that is able to successfully connect to RDS via JDBC.

However, since the RDS instance is not publicly accessible I want to use the EC2 instance to access the RDS instance from my dev PC. Everytime I do, I get "channel 2: open failed: administratively prohibited: open failed" on my PC.

Here is my command

ssh -i ~/key.pem -N -L 3307:rds-name-here.abcdefghi123.us-east-1.rds.amazonaws.com:3306 ec2-user@

Obviously I changed the details but thats the jist of the command. This is the only error I am getting and really don't know where else to look.

Any pointers in the right direction would he helpful. I am at a loss at the moment. I did confirm the security groups allow all traffic to and from each other. I did not modify the Network ACLs at all.

EDIT: I enabled some debug flags ( -vvv ) and it is responding with packet type 92?

debug2: fd 6 setting TCP_NODELAY
debug2: fd 6 setting O_NONBLOCK
debug3: fd 6 is O_NONBLOCK
debug1: channel 2: new [direct-tcpip]
debug3: send packet: type 90
debug3: receive packet: type 92
channel 2: open failed: administratively prohibited: open failed
debug2: channel 2: zombie
debug2: channel 2: garbage collecting

check /etc/ssh/sshd_config

You probably have tunneling disabled:

AllowTcpForwarding no

needs to be

AllowTcpForwarding yes

  • Nope just checked, both machines have this set. I don't think there is any secret information so I pasted it here for review incase something else could be causing it. It expires in 2 weeks, and the config file for the EC2 instance. – cinnafire Jun 12 at 20:06

So I found the answer... apparently it was a typo. I found another post telling me to look in /var/log/secure and there were errors there about not being able to find the endpoint. My problem is I was using the endpoint of an old replica read node that I used initially to see the data in my master, that has since been deleted. I didn't realize it because the full hostname is near identical and thought I had copied/pasted it.

So for other people that are looking into potential problems, check /var/log/secure, grep it for sshd and look for errors "Name or service not known". That is what was happening to me.

It works now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.