I want to be able to offer ssh accounts on my Linux server for people to be able to use for SSH tunnelling. All accounts will be locked down with no interactive shell, for tunnelling/port forwarding purposes only. My problem is that I don't want them to be able to access services that are bound to localhost only by doing port forwards like the following:

ssh account@server -L 9999: && telnet localhost 9999

Would give access to the default mysql database port. How can I stop this?

I see options in the configuration file for OpenSSH to allow specific ports/hosts, but not to block them.

3 Answers 3


Port forwarding by the SSH daemon is done by a non-privileged child process of the ssh daemon.

ssh jeff@localhost -R 9999:localhost:22
sudo lsof -i
sshd      4856  jeff   10u  IPv4  21933      0t0  TCP localhost:9999 (LISTEN)

Thus we can see that the SSH process responsible for forwarding ports is owned by the user. There are fancy ways to go about tagging packets for custom handling, but I think the easiest is this:

iptables -A OUTPUT -m owner --gid-owner 1000 -d -j REJECT --reject-with icmp-admin-prohibited

Put all your users into the same group, put that group in the rule, and put that rule at the top of your list before any allow rules. Note that I used -- anything in the 127 netblock will get you to the local host, so don't just block

Also, consider adding a similar rule to block access to your external interface IP. It is a crafty way to bypass the firewall rules.

  • Do you need another rule for the ethernet device too? Isn't this just covering the loopback device? Commented Dec 18, 2011 at 6:32
  • Thats perfect, thank you so much - I had no idea you could target specific GID's with iptables :D Commented Dec 18, 2011 at 13:35

Allowing some forms of ssh forwarding / tuneling, but not others

You can edit the sshd config at /etc/ssh/sshd_config to:

  • enable reverse forwarding (i.e. -R is allowed, which is what you want)
  • but disable local forwarding (i.e. -L is not allowed, which is what you want)

You can do this globally by setting in your sshd_config:

AllowTcpForwarding remote

or you can do it on a per-use basis with:

# disable Tcp Forwarding for all by default
AllowTcpForwarding no

# allow remote Tcp forwarding for user some_username
Match User some_username
    AllowTcpForwarding remote

Note / Edit: locking the user from doing anything else

I did not mention this initially, as it is already mentioned in the initial question, but the user should be denied logging, so that they cannot set up their own forwarder.

You can do this by setting the default shell for the user to /usr/sbin/nologin in the etc/passwd file for example. The user will have to use

ssh -NR remote_port:localhost:local_port some_username@server_address

to set up the reverse tunnel, where the -N command means that this is only for port forwarding, not for attempting to execute command / get a shell.

Looks like (but I have not tried it myself) this can also be done directly in /etc/sshd_config by adding something like (you could send to another / possible custom shell script to display something or do any other action):

Match User some_user
  ForceCommand /usr/sbin/nologin

or possibly (I have not tested if -NR still works then) adding something like this instead if you want to show a banner:

Match User guest
    Banner /etc/ssh/some_custom_banner_in_a_text_file
    DenyUsers guest
  • 1
    Ah, I somehow missed the fact that you edited it. Yes, your original was not a well-formed answer. This is much better. I'll let people who are more versed in ssh_config to weigh in on the technical details.
    – schroeder
    Commented Mar 8, 2022 at 9:23
  • According to man sshd_config, forwarded users should also be denied shell access.
    – A. Hersean
    Commented Mar 8, 2022 at 10:16
  • yes, but this was already a part of the initial post, right? :) "All accounts will be locked down with no interactive shell, for tunnelling/port forwarding purposes only.", from the initial post. Still, can make it clearer in the answer, will edit now.
    – Zorglub29
    Commented Mar 8, 2022 at 10:46
  • @A.Hersean added the edit about locking the user from doing anything else, does this look good to you? :)
    – Zorglub29
    Commented Mar 8, 2022 at 11:02
  • 1
    Your edit is fine by me. Even though the OP already denied shell access, other readers might not think this is a requirement.
    – A. Hersean
    Commented Mar 8, 2022 at 13:01

If you only fixed port forwardings are permitted, then you may restrict them with permitopen="host:port". Google claimed some commercial ssh daemon that offers a restricted port forwarding option, but that looked global, not just one user.

  • This is usually ill-advised. I find it often comes up to load novel port forwards. Far better to block the handful that really should not work.
    – Joshua
    Commented Mar 27, 2017 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .