how would one limit ssh tunnel access?

Question

I have a SSH service on a VPS (linux if it makes any difference) and i recently bought and one of the uses for it is to make a secure SOCKS proxy tunnel. My issue is it allows all traffic on any port to forward through. Is there a way on the server end I can limit this to certain ports perhaps by using iptables?

Would i need to make an OUTPUT or FORWARD rule? If so how can I tell the rule that it only applies to ssh traffic?

Answer 1

The PermitOpen option to sshd on the server side looks like it will do what you want. You can also combine this with the Match User option to limit by user. For example:

Match User alice
PermitOpen www.example.com:80 server2.example.com:443