Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a SSH service on a VPS (linux if it makes any difference) and i recently bought and one of the uses for it is to make a secure SOCKS proxy tunnel. My issue is it allows all traffic on any port to forward through. Is there a way on the server end I can limit this to certain ports perhaps by using iptables?

Would i need to make an OUTPUT or FORWARD rule? If so how can I tell the rule that it only applies to ssh traffic?

share|improve this question
up vote 1 down vote accepted

The PermitOpen option to sshd on the server side looks like it will do what you want. You can also combine this with the Match User option to limit by user. For example:

Match User alice
share|improve this answer
See also permitopen="host:port" in authorized_keys if using key-based authentication. – dmourati Apr 3 '12 at 22:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.