Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up an SSH account on my server for someone, and I only want to give them access to tunneling internet traffic. I set their user's "shell" to /bin/true, so now when they SSH (and use -N), the tunnel works with no shell (this is what I want).

Now, I was wondering if there was a way to only allow web browsing traffic through (and not bittorrent, email, etc). In sshd_config, I tried:

PermitTunnel yes
PermitOpen any:80

But that doesn't allow any traffic through for some reason. Is there a way I can make it so the person can only use, for example, a web browser through my tunnel?

Thanks, I can supply any information you need.

The server is running Fedora 15, and I know how to use Linux so I don't need baby instructions.

PS: Additionally, is it possible to log the activity of an SSH tunnel? Like, to see what information goes through it? I know /var/log/secure has the login logs (although, with /bin/true instead of /bin/bash, logins don't show up), but not activity logs.

share|improve this question
up vote 6 down vote accepted

The PermitOpen accepts any when its the only argument. Meaning it accepts PermitOpen any.
The only way I can think of to do this would be to use an iptables rule.

iptables -I OUTPUT -p tcp ! --dport 80 -m owner --uid-owner 1000 -j REJECT

This would reject any outbound traffic from user with UID=1000 that isnt going to port 80

share|improve this answer
Thank you! That is exactly what I wanted – Chris Jan 12 '12 at 0:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.