Sshd : Operation not permitted
-
Hi all,
I have this problem quite awhile. Sometimes some connections through ssh tunnel gets blocked by pfSense with the following log.
sshd[29077]: error: connect to <ip_of_the_web_paget>port 80 failed: Operation not permitted
As ssh client, I am using putty with 4D8080 (IPv4, Dynamic, source port:8080) config.
I searched this in the Internet but couldn't find anything.</ip_of_the_web_paget>
-
As an ssh proxy?
-
As ssh proxy I am using SSH daemon in pfSense.
-
Ok, the page you're trying to connect to, is it part of the webgui? What User are you logged in as?
Steve
-
The page is a standard web page such as www.ebay.com . However, it is not a constant web page. it can vary. So it is not a site specific issue. When problem occurs I get "Connection was reset" message.
The scenario and the config:
I have a PC on a cooperate network and pfsense at my home. To access local servers at my home I have an OpenVPN session from coop network to home. However, I am not using the gateway at home to tunnel all my internet connection.
I only want firefox traffic to use my internet connection at home. Therefore, there is an underlying SSH tunnel inside of the OpenVPN connection.
The user that authenticates both openVPN and SSH tunnel is same and have required privileges.
-
Hmm, you say you've seen this for while, before that it worked fine?
Anything happen since like upgrading to 2.2 etc?Steve
-
Yes, I have been seen this for a while. After upgrading 2.2 it just started to happen more often (once on a random website everyday).
-
Ok but there was a time when it didn't happen at all or has it always occasionally suffered reset connections?
Steve
-
I have been using pfsense since 2.0 Beta. As far as I remember the problem was always there however I am not 100% sure. I wasn't using the ssh tunnel in the past as often as today. In the last couple of months I started to use SSH tunnel more often.
-
Everything I'm seeing relating to this error is pointing at an issue with Firefox trying to use an http proxy instead of a socks proxy. However that is not something occasional but rather it breaks it entirely.
Steve
-
Possible workaround would be to setup squid on pfSense, tunnel its proxy port locally over ssh and then use it as http proxy.
-
Thanks for the answers.
When I reproduce the issue I will try few things and let you know
@dgcom
That seems to be a good workaround. If I can't troubleshoot the problem then I will go with that. Thanks
