Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to restrict SSH tunnel functions. Users should not be allowed to create remote tunnels but only tunnels to localhost. I tried to setup the whole thing in the SSH configuration but I can only turn off the TCPForwarding completely there. I guess this might only be possible with iptables then? Does anyone have experience and can help me out?

share|improve this question
up vote 1 down vote accepted

For OpenSSH you can use PermitOpen host:port to limit where users can tunnel to. To let them tunnel to MySQL that only listens locally on the default port:

PermitOpen LocalHost:3306

From the man page for sshd_config:


Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms:

PermitOpen host:port
PermitOpen IPv4_addr:port
PermitOpen [IPv6_addr]:port

Multiple forwards may be specified by separating them with white space. An argument of any can be used to remove all restrictions and permit any forwarding requests. An argument of none can be used to prohibit all forwarding requests. By default all port forwarding requests are permitted.

share|improve this answer
Thanks for your reply, it works with localhost:<PORT> but not with "any". It seems like every single port needs to be inserted at this point. – Vladislav Dzabantov Oct 8 '13 at 11:59
Correct. Still usually not that many local ports users would want to connect to anyway. – Brian Oct 8 '13 at 12:08
That's right but it's might be worth a feature request ;-) – Vladislav Dzabantov Oct 8 '13 at 12:09
@Brian Try using PermitOpen localhost:* – kurtm Oct 8 '13 at 12:31
@kurtm this gives the error "bad port number in PermitOpen" – Vladislav Dzabantov Oct 8 '13 at 12:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.