Take the 2-minute tour ×

Is it possible to limit port forwarding with OpenSSH? I'd like to let users ssh -R on ports 6000..7000, but I'd like to block ssh -D and ssh -L.

share|improve this question
add comment

3 Answers

The configuration directives for sshd_config that you're interested in include:


There does not seem to be any granularity in regards to restricting the type of port forwarding allowed.

However, pay attention to the documentation for the AllowTCPForwarding option:

         Specifies whether TCP forwarding is permitted.  The default is
         security unless users are also denied shell access, as they can
         always install their own forwarders.

The concept being that if your users have shell access, it's trivial for them to setup their own forwarding once they are logged in using a utility such as netcat. This would circumvent any sshd configuration settings.

share|improve this answer
add comment

There's also the use of iptables which lets you have fined grained control over the ports that are allowed to be connected and/or forwarded.

share|improve this answer
add comment

http://www.manpagez.com/man/8/sshd/ Search for PermitOpen

I do:

Match User Blah
PermitOpen BlahComputer:3389

share|improve this answer
add comment

Your Answer


