Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My understanding is when creating an ssh tunnel to a remote machine, the ports become open on that machine for anyone to use and connect back to my local box (not just the user who opened the tunnel). Is there a way to restrict access to the ports opened on the remote machine to a specified unix group? I was thinking this may be possible via an iptables rule or some other TCP/IP port restriction but I am not entirely sure.


share|improve this question
up vote 3 down vote accepted

You can use the iptables owner module to match the UID or GID of the originating socket, but this only works for packets originating locally (i.e. from the remote machine).

% ssh -fNR 20022:localhost:22 localhost
% sudo iptables --append OUTPUT --destination --protocol tcp --dport 20022 --match owner \! --uid-owner mgorven --jump REJECT
% sudo iptables -nvL OUTPUT
Chain OUTPUT (policy ACCEPT 40 packets, 6349 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     tcp  --  *      *              tcp dpt:20022 ! owner UID match 1000 reject-with icmp-port-unreachable
% telnet 20022
Connected to
Escape character is '^]'.
SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
telnet> Connection closed.
% sudo telnet 20022
telnet: Unable to connect to remote host: Connection refused
share|improve this answer
That may work fine, as I am trying to prevent random users on the remote machine to access the ports I have opened locally. – jzalger Jun 12 '12 at 23:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.