v3.27 bug: ssh port forwarding is not working

MartinT · Wed Jul 22, 2009 2:14 am

In v3.27 is not working ssh port forwarding functionality (or not allowed in ssh service), experienced on RB433AH. By ssh port forwarding I mean tunneling TCP connection trough SSH session to Mikrotik router. For example (in terminal on Linux desktop):

ssh -L 8291:localhost:8291 admin@my-mikrotik;

After that trying winbox on localhost:8291 will not work and on ssh console is printed "channel 3: open failed: administratively prohibited: bla bla".
Similar with

ssh -L 2222:OtherMikrotik:22 admin@my-mikrotik;

Ssh port forwarding is working in v3.22 and previous versions (did not try version between v3.22-v3.27). CHANGELOG_3 does not show any record about changing this feature -> looks like a bug.

yuri1394 · Sun Aug 02, 2009 6:28 pm

I'm experiencing same problem in 3.27 and 3.26. It works in 3.25 and older versions.
This feature is great to fast access remote network devices behind nat without classic port forwarding. I used this feature with ssh client putty. There is item Connection-SSH-Tunnels in menu of putty which is not working now.
Thank you for repairing in comming version of RoS.

NAB · Mon Aug 03, 2009 2:20 pm

...because you bastards won't give it to us!

From personal experience (IPv6 over PPPoE), I know how frustrating it is when features you rely on are removed with no notice and no apology, however, there is no justification for abuse at all - it doesn't help things, it just upsets the people who you really don't want to upset. What happens the next time you have a query? Why should they bother replying to somebody who abuses them? As I have found with the IPv6/PPPoE issue, Mikrotik simply ignore any topics in which they have been (mildly in this case) abused.

That having been said, Mikrotik's release notes leave a lot to be desired and there really should have been some mention of changes to the SSH subsystem (if, indeed, there was one) and the reason for these changes.

I also agree that it can be frustrating that older versions of the software are not available. I strongly suspect that Mikrotik would supply any older version if you didn't have it yourself, however having all versions on-line would be a nicer way of doing things. as the number of RBs we have increases, I think I will start archiving all the firmware (in all versions) just in case. It would have been sensible of me to have started doing this a long time ago.

Mon Aug 03, 2009 2:46 pm

I never knew RouterOS had such ability. I will check what went wrong.

Mon Aug 03, 2009 2:50 pm

Nick, over 50% of all technical support email question are fixed by simple upgrade. If people would just use the latest version, we would solve a lot of delays in email responses. In new versions there are certainly more fixes than issues. It's obvious that new versions are released to improve older ones, and if people don't use them, we can't fix their issues. This is why we don't advertise any old version archive, and this is why we have one older version listed (v3.13) so you have a fallback possibility in case of a sudden problem.

NAB · Tue Aug 04, 2009 4:17 pm

Nick, over 50% of all technical support email question are fixed by simple upgrade. If people would just use the latest version, we would solve a lot of delays in email responses.

That may well be the case, but it wasn't the point I was making.

I am surprised at your response though - I was trying to offer a measured post in response to the OP's abusive language and tone which I found offensive and quite unnecessary.

However, I am puzzled why you suggest that everybody should be using the latest version when some features (e.g. IPv6/PPPoE) have been removed, forcing users to stay with older firmware versions. Unfortunately, the problems with the latest 3.x releases have certainly caused me to be more reluctant to immediately upgrade all our RBs as I simply don't know what will work and what won't any more.

Given the recent problems, I don't think it is unreasonable to expect users to hang back one or two releases from the latest version just in case.

changeip · Tue Aug 04, 2009 6:40 pm

again - just so everyone knows, ipv6 over pppoe was NOT a feature. It just so happened it worked. It was not something they added on purpose. It broke encryption on certain PPP tunnels > 1280 MTU and so they disabled it. You could be running a tunnel unencrypted without knowing it. I would rather they have fixed the PPP code and not just disabled ipv6 over tunnels, but they must have their reasons.

Anyone else that needs ipv6 over a tunnel (l2tp, pptp, ipip, pppoe, etc) please just post to the original thread and ask for it to be fixed.

Normis, yes, RouterOS would do ssh tunneling probably because its just built into the ssh daemon. Sometimes a handy feature to have for a simple winbox or ssh redirect.

NAB · Tue Aug 04, 2009 9:54 pm

again - just so everyone knows, ipv6 over pppoe was NOT a feature. It just so happened it worked.

Understood, but given that other products support IPv6/PPPoE, that there is at least one RFC stating how it should work and that it did work (your point on encryption is also understood), I think it is fair to assume that it was a feature of RouterOS. Simply removing it and then writing everything which was said in the thread (I'll not rehash it here) was, in my opinion, out of order.

To be clear, I understand why IPv6/PPPoE was disabled, I just don't happen to agree with the reasons, nor with the opinion that I shouldn't have been using it in the first place.

Anyway, that's the last from me on IPv6/PPPoE in this thread. I didn't want to discuss it here and was just using it as an example to try to persuade the OP to curb his abuse a little.

MimiFleX · Wed Aug 05, 2009 6:22 pm

Same problem here on 3.27.
This feature is very useful for us, and we are using it every day.

We hope to see it working again in the next release.

Regards,

Thu Aug 06, 2009 8:46 am

This feature was disabled because it posed a security risk to those, who didn't know about it. We are making a new SSH package right now, where this feature will be integrated, and will be configurable (ie. you will be able to turn it on if you want).

pdinoto · Sat Aug 08, 2009 9:47 pm

A security risk? It is a feature that does not work unless you are actually connected to the router using SSH, which means you already authenticated.

Anyway, if you want to be paranoid about security, make it disabled by default, but configurable.

SSH port forwarding is THE swiss-army-knife of network admin, and having that in mikrotik has been the reason to replace lots of routers with mikrotik hardware.

On the other hand, this brings up the issue of "ChangeLog" being quite bogus, as a modification in the configuration of sshd (or dropbear) should be announced there.

Cheers,
///Pablo

Chupaka · Sun Aug 09, 2009 9:55 pm

Anyway, if you want to be paranoid about security, make it disabled by default, but configurable.

We are making a new SSH package right now, where this feature will be integrated, and will be configurable (ie. you will be able to turn it on if you want).

jp · Tue Aug 18, 2009 8:57 pm

I use this between linux hosts for secure remote database access. (Lets a local database client access a remote database as if it were local)

Never thought to use it with Mikrotiks for the purposes described, but it could indeed be handy!

I could concur this sort of change should be in the changelog if it was an intentional change.

MartinT · Thu Sep 24, 2009 7:51 pm

[quote="normis"]This feature was disabled because it posed a security risk to those, who didn't know about it. We are making a new SSH package right now, where this feature will be integrated, and will be configurable (ie. you will be able to turn it on if you want).[/quote]

I checked v3.30, problem still remain. I did search for any configuration option ("ip service set ssh .." and "user ssh-keys set ..") unsuccessfully.

Normis, can you tell us more about planed SSH package (when, how configure ...). Thank you.

toomas · Tue Oct 13, 2009 9:37 pm

any progress with that issue?

fewi · Tue Oct 13, 2009 9:47 pm

The 4.0 release from today still doesn't permit port forwarding:

2009-10-13 11:48:19	Opening forwarded connection to localhost:8291
2009-10-13 11:48:19	Forwarded connection refused by server: Administratively prohibited [bla bla]

dssmiktik · Wed Oct 14, 2009 4:09 am

Mikrotik replied in a email about this issue:

Hello,
that feature wont be added back as it is grate security risk to your network.
Instead you should create dst-nat rules to forward ports and then you will be
aware that nat for that prot+host exists and you have to secure it. That Also
gives more power to create different policies using firewall filter, and thus,
results in more secure and safe network.

jp · Wed Oct 14, 2009 2:00 pm

I would say it's more secure than port forwarding+firewalling as MT suggest as an alternative.

First, we use firewall with ssh, (which I think should default with MT), so I can compare SSH with port forwarding+firewalling with respect to security.

Essentially, the goal could be done with either SSH or port forwarding. The SSH is authenticated with an ssh key, which is a very secure method of connecting. Port forwarding, no authentication.

If SSH isn't safe in MT, it should be made so, and the tool for doing that is the firewall. OpenSSH has a LOOOONNNNNGGG history of security problems, and I've been adminning through most of it, so I have always kept SSH firewalled so that our servers are protected from ssh probing. It has been much better in the past couple years, but I feel better about people not probing my ssh. You see it all the time on MT if you don't control access to ssh with firewall. It will fill up your logs.

Since newbies will use winbox most likely to access the router they'd be unaffected, something like this would go a long way to make MT more secure out of the box.

ip firewall filter
add action=accept chain=input comment="change src-address or duplicate for additional subnet to allow local lan admin" disabled=no dst-port=21-23 protocol=tcp src-address=192.168.0.0/16
add action=reject chain=input comment="disable to allow ssh/ftp/telnet from internet" disabled=no dst-port=21-23 protocol=tcp reject-with=icmp-network-unreachable src-address=0.0.0.0/0

Chupaka · Wed Oct 14, 2009 10:23 pm

Mikrotik replied in a email about this issue:

omg... who's author? O_o

toomas · Wed Oct 14, 2009 11:19 pm

Hello,
that feature wont be added back as it is grate security risk to your network.
Instead you should create dst-nat rules to forward ports and then you will be
aware that nat for that prot+host exists and you have to secure it. That Also
gives more power to create different policies using firewall filter, and thus,
results in more secure and safe network.

Dear Mikrotik,

As your humble user, I'd like to take liberty to remind You a very well known quote: Guns don't kill people, people kill people - ssh port forwaring is no to be blamed, but unqualified admins. Like we don't switch off php in apache if there is some unescaped sql queries which drop your databases? or do you?

This feature was disabled because it posed a security risk to those, who didn't know about it. We are making a new SSH package right now, where this feature will be integrated, and will be configurable (ie. you will be able to turn it on if you want).

That would be fine, disabled for unaware, enableable for ones who need it.

dssmiktik · Wed Oct 14, 2009 11:53 pm

Mikrotik replied in a email about this issue:
omg... who's author? O_o

Think what you want I suppose. Fact is, it's not going to be added back in.

Thu Oct 15, 2009 10:26 am

I don't know who wrote this, but it's not true. It's a security risk only if you don't know that this feature exists (it wasn't documented and configurable). We are working on a new SSH package that will have this feature, you will be able to turn it on if you need it.

dssmiktik · Thu Oct 15, 2009 11:07 am

Normis, you guys apparently need to communicate more

Thu Oct 15, 2009 11:09 am

I removed your posted mails, I have talked to Janis K, he was misinformed.

dssmiktik · Thu Oct 15, 2009 11:16 am

I removed your posted mails, I have talked to Janis K, he was misinformed.

So SSH port forwarding is planned to be added back in a future version of RouterOS? I wasn't wrong then, I was simply posting exactly what I was told from a Mikrotik support person.

Thu Oct 15, 2009 11:24 am

I know, that's what I said. I just confirmed that it's still in the "feature request" list and will be made.

webasdf · Mon Oct 19, 2009 5:19 am

Ouch! This is the first I heard of this...explains why I couldn't dial in through my SSH tunnel to my desktop while I was away this weekend. You've got my vote to add it back in asap. This is a very valuable feature! I use it alot to tunnel to my home PC from remote and for work at our mikrotik-enabled hot spots. It is also valuable to reach equipment behind a NAT that doesn't have a default gateway configured on it (this is for equipment that we did not install, but took over the management of it). In that situation dst-nat won't work. SSH tunnel is the only way.

Is there an estimated date for a fix?

Chupaka · Mon Oct 19, 2009 9:40 am

It is also valuable to reach equipment behind a NAT that doesn't have a default gateway configured on it (this is for equipment that we did not install, but took over the management of it). In that situation dst-nat won't work. SSH tunnel is the only way.

in that case, you need src-nat, not dst

dssmiktik · Tue Nov 17, 2009 12:04 am

Just wanted to update for completeness:

In RouterOS v4.2 x86:

[admin@MikroTik] > channel 3: open failed: administratively prohibited: bla bla

Hopefully will be brought back in v4.3.

Mikrotik any plans? Since it was in a previous version, it's kindof important to get it back I think, since it's not a "new" feature.

gacopl · Sun Dec 06, 2009 4:09 pm

+1 for port forwarding.
when you are using for egz campus network when almost everything is blocked, besides the standard 80 port and SSH for outgoing connections.

the only way to administer your network is to tunel OpenVPN over SSH. then you gain access to unlimited internet and/or local resources wherever you are.

I was also dissapointed when i found out about that, after i upgraded, but it's not first time MT has done something like this.

My wish is that MT will take more care about changelog.

And i also hope you will release ssh package for 3.30 as i want back my functionality without need to buy new license.

B/R
Michal

Chupaka · Sun Dec 06, 2009 4:30 pm

And i also hope you will release ssh package for 3.30 as i want back my functionality without need to buy new license.

btw, upgrade to v4 is free for any v3 owners

astounding · Thu Dec 10, 2009 1:06 am

Thanks, MikroTik, for responding to customer requests to add SSH port forwarding back! I look forward to it greatly! (I use it a LOT.)

Aaron out.

Thu Dec 10, 2009 10:59 am

What I wrote before still stands:

It's a security risk only if you don't know that this feature exists (it wasn't documented and configurable). We are working on a new SSH package that will have this feature, you will be able to turn it on if you need it.

astounding · Thu Dec 10, 2009 11:23 pm

normis: I must not have been clear. I was thanking MikroTik, and indirectly YOU specifically, for responding so very well to users' needs. We appreciate it!

Aaron out.

jendik · Fri Dec 11, 2009 12:14 pm

Hi There,

I'd like to tell you I spent a lot of time finding out why SSH tunneling doesnt work anymore... I thought, there is some kind of problem with firewall rules... Then, I found this forum topic...otherwise I would thought there are some ghosts in there.

Why Mikrotik doesnt include important information like this into the changelog? I woudnt upgrade to this version if I knew that...

Please, could you help me with downgrading mikrotik to previous version which supports SSH tunneling(ssh port forwarding)... I can't find any previous package... I need one for for RB333...and I will probably need a lot of others for different RBs.. Could you tell me please where I can download it? What is the best way to downgrade and having the same configuration?

Even that I'd like to thank a lot to Mikrotik for good work they do and to all users of this forum as their comments that helped me many times before, even thought this comment is my first.

Thanks a lot
Kind regards
Jendik

Fri Dec 11, 2009 12:16 pm

It wasn't supposed to work before, this was not a feature. It was a bug.

I can confirm that the new SSH package already includes SSH forwarding option. Release date unknown.

jendik · Fri Dec 11, 2009 12:35 pm

...almost all Vendors say the sentence about bug and feature in the opossite way-)...

Could you help me please, finding previous bug versions? I really need this bug for lot of our routers... Any suggestions for downgrading please?

Thank you
J.

Fri Dec 11, 2009 12:38 pm

You will have to wait until we release a new version. that bug is a security risk because it can't be configured or controlled.

dssmiktik · Fri Dec 11, 2009 10:44 pm

...almost all Vendors say the sentence about bug and feature in the opossite way-)...

Could you help me please, finding previous bug versions? I really need this bug for lot of our routers... Any suggestions for downgrading please?

Thank you
J.

Hats off to you, I've never ever heard this before! People actually wanting "bugs", lol, Mikrotik, market things a bit better. You probably didn't invent the SSH package, and just about every single install of SSH on any server in the world supports tunneling. Given that, I don't think it's appropriate to call it a bug. Think of all the hard work the ssh team spent trying to implement ssh tunneling that is so widely used today, just for another company to call it a bug.

Anyway, I got a good laugh out this one

jendik · Fri Dec 18, 2009 1:59 pm

yea, it's the first time when I say it's a "feature" and Vendor says it's a "bug"-))
anyway... I need this bug/feature or whatever You call it back...

please, is there anybody, who could tell me, where I can download version 3.24 and the right way how to downgrade???

please..

thanks a lot!
J.

hilton · Fri Dec 18, 2009 3:20 pm

please, is there anybody, who could tell me, where I can download version 3.24 and the right way how to downgrade???

http://66.228.113.58/all_packages-mipsbe-3.24.zip

Copy to 'files' then under 'system, packages' hit the downgrade button. Should work.

od3m · Sat Dec 19, 2009 11:34 am

hey all,

waiting for ssh forwarding to come... really need this to access ssh on another device in LAN from outside.
maybe in 4.4 ?

od3m · Mon Dec 21, 2009 6:38 pm

works in 4.4

Chupaka · Mon Dec 21, 2009 7:57 pm

just works? without additional settings? %)

but it's insecure - why it wasn't mentioned in changelog?..

od3m · Mon Dec 21, 2009 7:59 pm

hi,
yeah just works.. i haven´t seen any settings for this. but it works.

astounding · Tue Dec 22, 2009 2:30 am

On an RB750G running 4.4 it does NOT work, or there IS a security setting somewhere to enable it that I haven't yet found. It fails with: "channel 3: open failed: administratively prohibited: bla bla"

Or that's a firewall rule of mine... (*quickly begins checking for blocked packets*) No, no dropped packets... (*double-checks the SSH connection to be sure the remote host is accepting connections*)

This has got to just be a firewall issue on my side if port forwarding is working for others on 4.4, esp. since that message is an OpenSSH error whenever it fails to connect to the forwarded site... Hmmm...

Aaron out.

astounding · Tue Dec 22, 2009 2:41 am

Tried it on another device (RB411) running 4.4 that does bridging with absolutely NO IP filters, no bridge filters, etc. with the same result. And I verified connectivity from the RB411 to the IP and port in question (/system telnet W.X.Y.Z 1234) to be sure that a forwarded connection SHOULD be able to connect. No go: "channel 2: open failed: administratively prohibited: bla bla"

Exploring around, I can't find a setting to tweak. So either SSH port forwarding in 4.4 remains disabled, or there IS a setting I haven't found.

Aaron out.

Tue Dec 22, 2009 9:33 am

the new SSH package is not yet released. Not sure why and how it works for some of you, we will check.

jendik · Tue Dec 22, 2009 4:24 pm

please, is there anybody, who could tell me, where I can download version 3.24 and the right way how to downgrade???
http://66.228.113.58/all_packages-mipsbe-3.24.zip

Copy to 'files' then under 'system, packages' hit the downgrade button. Should work.

THanks a lot!!! I downloaded PPC package as well-)

take care
j.

od3m · Tue Dec 22, 2009 4:38 pm

the new SSH package is not yet released. Not sure why and how it works for some of you, we will check.

i just left the filter / nat rules as they were before upgrade...
before the upgrade they doesnt work. but after upgrading to 4.4 they re working.
this really helps me because i need to arrive a debian server behind my rb450g via ssh.

but i think it depends on the update

webasdf · Thu Dec 31, 2009 5:08 pm

Quick and dirty way around this.

If your board supports metarouter with openwrt images, install one (do a search on the forums for openwrt) and then you can SSH tunnel through the OpenWRT image instead of RouterOS. Worked for me in testing. The only down side to this is that the Metarouter fans (myself included) are waiting on a fix to a bug that causes watchdog to reboot the box about every 20 minutes to couple hours. However, if the metarouter is disabled when you don't need it this bug should not present itself.

Still looking forward to this feature being re-enabled.

magnavox · Mon Jan 11, 2010 4:47 pm

In v3.27 is not working ssh port forwarding functionality (or not allowed in ssh service), experienced on RB433AH. By ssh port forwarding I mean tunneling TCP connection trough SSH session to Mikrotik router. For example (in terminal on Linux desktop):
Code: Select all
ssh -L 8291:localhost:8291 admin@my-mikrotik;
After that trying winbox on localhost:8291 will not work and on ssh console is printed "channel 3: open failed: administratively prohibited: bla bla".
Similar with
Code: Select all
ssh -L 2222:OtherMikrotik:22 admin@my-mikrotik;
Ssh port forwarding is working in v3.22 and previous versions (did not try version between v3.22-v3.27). CHANGELOG_3 does not show any record about changing this feature -> looks like a bug.

Hi Mikrotik staff, any news?

I some routers running ROS 4.4 and receive "channel 2: open failed: administratively prohibited: bla bla" trying winbox via SSH tunnels.
Routers running 3.20 work fine...

Chupaka · Mon Jan 11, 2010 6:09 pm

"bla bla" eats my brain %)

magnavox · Mon Jan 11, 2010 6:12 pm

"bla bla" eats my brain %)

This is the exact RouterOS error message!!!

Chupaka · Mon Jan 11, 2010 6:51 pm

I know, that's why it does

Fri Feb 05, 2010 1:30 pm

any update on ssh tunnels being made available ?

pdinoto · Fri Mar 12, 2010 1:58 am

Anybody has any idea if newer versions of RouterOS have the SSH port forwarding functionality back in place?

It is march 2010 and still no official --or unofficial, for that matter-- stance about this.

I guess Mikrotik engineering staff does not really do any real admin work on live networks.

On the other hand, taking more than a year to fix an issue that was stubbornly introduced
by lack of knowledge is unacceptable. Come on! It is just changing a #define in a .config file.

I hope there is no "ip packet forwarding failed: administratively prohibited: wee wee" message in a later version.
After all, moving packets between networks could lead to a security issue.

MartinT · Fri Mar 12, 2010 10:41 am

Anybody has any idea if newer versions of RouterOS have the SSH port forwarding functionality back in place?

It looks like not. Latest version is 4.6, but we don't have it installed anywhere. I tested it on 4.5 - not working. I tried to find any "config option" for switch on of "ssh port forwarding funcionality" (as some people from Mikrotik mentioned above), unsuccessful. Changelog does not have any info about it (unfortunately, they do not write there this type of regression/fix).

I guess Mikrotik engineering staff does not really do any real admin work on live networks.

Have same feeling.

Chupaka · Fri Mar 12, 2010 4:33 pm

RouterOS v5 will have this possibility back

Mon Mar 15, 2010 10:00 am

It is march 2010 and still no official --or unofficial, for that matter-- stance about this.

you need to follow up on MikroTik's announcements

http://www.tiktube.com/?video=337

davewbrandt · Thu Mar 18, 2010 5:24 pm

From reading these posts it seems that the versions newer than 3.27 won't allow forwarding of ssh on port 22 to an inside host. I am having trouble trying to do just that. It may be something that I am not getting right. I can post specifics, but would like to know if it is still possible.

fewi · Thu Mar 18, 2010 5:29 pm

From reading these posts it seems that the versions newer than 3.27 won't allow forwarding of ssh on port 22 to an inside host. I am having trouble trying to do just that. It may be something that I am not getting right. I can post specifics, but would like to know if it is still possible. :?

If you're using a RouterOS version between 3.27 and 5beta you cannot do SSH port forwarding.

davewbrandt · Thu Mar 18, 2010 8:53 pm

Is 5beta ready? I don't see it in the download area.

fewi · Thu Mar 18, 2010 9:01 pm

No, it apparently is in pre-release: http://forum.mikrotik.com/viewtopic.php?f=1&t=39974

You definitely shouldn't be using it on production gear yet.

edmidor · Wed Mar 24, 2010 6:07 pm

@Mikrotik
Can't you guys just issue a patch with ssh fixes?
Not having SSH tunneling capability for so long is really a problem

dssmiktik · Thu Mar 25, 2010 5:14 am

v5 beta works with ssh forwarding. I still can't run commands remotely from the RouterOS ssh client. This would be really handy. Also, I'd like to login using DSA keys from the RouterOS ssh client as well.

janisk · Thu Mar 25, 2010 8:24 am

in 5.0beta whole ssh thing is rewritten from ground up. Newer builds of it now work properly for remote commands.

edmidor · Thu Mar 25, 2010 3:20 pm

Is beta stable enough to use in production (just a small LAN) ?

Chupaka · Thu Mar 25, 2010 5:02 pm

at least, wait for public beta release =) for now, it's something like alpha

dssmiktik · Thu Mar 25, 2010 10:07 pm

janisk,

I was referring to the the ssh client on the RouterOS itself.

Something like this:

[admin@Mikrotik] > /system ssh address=<ip> user=<user> password=<password> command=<command>

and

[admin@Mikrotik] > /system ssh address=<ip> user=<user> ssh-key=<dsa key in /certificates> command=<command>

This if more of a feature request though, I don't mean to steer off topic.
For reference, I never had any issue with remote command execution from ssh to RouterOS, only port forwarding.
I was specifically talking about command execution from within RouterOS's ssh client itself to another ssh server.

edmidor · Wed Apr 28, 2010 6:45 pm

v4.8 - and it's still not there, sigh...

Chupaka · Wed Apr 28, 2010 8:00 pm

it is there in v5

Thu Apr 29, 2010 8:48 am

v4.8 - and it's still not there, sigh...

new features go into v5 beta, don't expect it in v4.

yuri1394 · Thu May 20, 2010 2:01 pm

Thanks to all developers of mikrotik, it works in RoS 5. Good work

cdiggity · Mon Jul 26, 2010 9:27 am

v4.8 - and it's still not there, sigh...
new features go into v5 beta, don't expect it in v4.

except it isn't a new feature, it is a regression that is fixed as the feature existed in version prior to 3.27.

Chupaka · Mon Jul 26, 2010 10:36 am

it's not, and it was said earlier =)

evgeny777 · Thu Jan 20, 2011 2:15 am

Dear developers,

I appreciate the work you are doing and you've created a nice brand. But with things like this you're killing it.. I had to downgrade my router version today and that sucks. I understand you want to have better product, but I want my functionality I paid for. Come on guys this thread is 1,5 year old, what's so complicated on old good ssh forwarding to fix it that long? Besides it wasn't broken at all, it is a matter you see things. Dnat to somebody's network isn't much better idea.

Yours faithfully

Who is online