Summary

The Hetzner guide recommends accessing the OpenClaw gateway via SSH tunnel, but does not mention that AllowTcpForwarding must be enabled in the VPS sshd config for this to work.

Problem to solve

https://docs.openclaw.ai/install/hetzner

Users who follow SSH hardening best practices will hit this silently:

channel 3: open failed: administratively prohibited: open failed

This error gives no indication that sshd config is the cause.

Proposed solution

Add a prerequisite note to the SSH tunnel step in the Hetzner guide:

Prerequisite: Ensure your VPS sshd config allows TCP forwarding. If you have hardened your SSH config, set AllowTcpForwarding local (allows inbound port forwarding from your work machine, blocks outbound). Setting it to no will cause the tunnel to fail.

Where in the docs

Hetzner guide → Step 8 (Hetzner-specific access), before the tunnel command:

ssh -N -L 18789:127.0.0.1:18789 root@YOUR_VPS_IP

Alternatives considered

An alternative is to use the terraform and/or docker configs proposed at the end of the documentation. But if the intent is to control and master the setup of openclaw on a host machine with docker, the hetzner-specific doc may need adjustments that likely apply to all cloud-hosted environments

Impact

Environment

• Hetzner Ubuntu 22.04 VPS
• OpenClaw latest (March 2026)
• SSH key auth only, hardened sshd config

Evidence/examples

xxx@ubuntu-4gb-hel1-1:~$ channel 3: open failed: administratively prohibited: open failed
channel 3: open failed: administratively prohibited: open failed

Additional information

No response