Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to limit port forwarding with OpenSSH? I'd like to let users ssh -R on ports 6000..7000, but I'd like to block ssh -D and ssh -L.

share|improve this question

The configuration directives for sshd_config that you're interested in include:


There does not seem to be any granularity in regards to restricting the type of port forwarding allowed.

However, pay attention to the documentation for the AllowTCPForwarding option:

         Specifies whether TCP forwarding is permitted.  The default is
         ``yes''.  Note that disabling TCP forwarding does not improve
         security unless users are also denied shell access, as they can
         always install their own forwarders.

The concept being that if your users have shell access, it's trivial for them to setup their own forwarding once they are logged in using a utility such as netcat. This would circumvent any sshd configuration settings.

share|improve this answer

There's also the use of iptables which lets you have fined grained control over the ports that are allowed to be connected and/or forwarded.

share|improve this answer Search for PermitOpen

I do:

Match User Blah
PermitOpen BlahComputer:3389

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.