7

Normally an ssh client can request TCP forwarding using the -L command line option. The server can disable this completely using AllowTcpForwarding no. If enabled, the client can request to connect the endpoint to a remote machine other than the sshd server using host in -L port:host:hostport. Is there a way to configure sshd to limit the destination forwarding address to localhost (ie. the sshd server machine itself)?

1 Answer 1

Reset to default
10

A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction.

edit

See the PermitOpen directive:

Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms:

              PermitOpen host:port
              PermitOpen IPv4_addr:port
              PermitOpen [IPv6_addr]:port

Multiple forwards may be specified by separating them with whitespace. An argument of “any” can be used to remove all restrictions and permit any forwarding requests. By default all port forwarding requests are permitted.

5
  • The GatewayPorts applies to ports forwarded for the client, that is, with the client -R option. I'm looking for a restriction on the destination addresses when using -L.
    – Greg Hewgill
    Nov 4, 2011 at 0:47
  • It works both for -R and -L, but I see what you mean now, you want to restrict the origin of a forward to a localhost. That's trickier. Gatewayports restricts the destination .
    – ata
    Nov 4, 2011 at 1:15
  • I already have GatewaysPorts no in my sshd_config. I can use ssh -L 1234:anotherhost:1234 server to set up a tunnel to anotherhost. What I want is to allow ssh -L 1234:localhost:1234 server but disallow ssh -L 1234:anotherhost:1234 server.
    – Greg Hewgill
    Nov 4, 2011 at 1:22
  • Thank you, PermitOpen is the option I was looking for! Not sure how I missed that in the man page.
    – Greg Hewgill
    Nov 4, 2011 at 1:26
  • > It works both for -R and -L. GatewayPorts in ~/.ssh/config sets the policy for -L. GatewayPorts in remote host's /etc/ssh/sshd_config sets the policy for -R.
    – ScumCoder
    Mar 1, 2020 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .