Normally an ssh client can request TCP forwarding using the -L command line option. The server can disable this completely using AllowTcpForwarding no. If enabled, the client can request to connect the endpoint to a remote machine other than the sshd server using host in -L port:host:hostport. Is there a way to configure sshd to limit the destination forwarding address to localhost (ie. the sshd server machine itself)?


A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction.


See the PermitOpen directive:

Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms:

              PermitOpen host:port
              PermitOpen IPv4_addr:port
              PermitOpen [IPv6_addr]:port

Multiple forwards may be specified by separating them with whitespace. An argument of “any” can be used to remove all restrictions and permit any forwarding requests. By default all port forwarding requests are permitted.

  • The GatewayPorts applies to ports forwarded for the client, that is, with the client -R option. I'm looking for a restriction on the destination addresses when using -L. – Greg Hewgill Nov 4 '11 at 0:47
  • It works both for -R and -L, but I see what you mean now, you want to restrict the origin of a forward to a localhost. That's trickier. Gatewayports restricts the destination . – ata Nov 4 '11 at 1:15
  • I already have GatewaysPorts no in my sshd_config. I can use ssh -L 1234:anotherhost:1234 server to set up a tunnel to anotherhost. What I want is to allow ssh -L 1234:localhost:1234 server but disallow ssh -L 1234:anotherhost:1234 server. – Greg Hewgill Nov 4 '11 at 1:22
  • Thank you, PermitOpen is the option I was looking for! Not sure how I missed that in the man page. – Greg Hewgill Nov 4 '11 at 1:26
  • > It works both for -R and -L. GatewayPorts in ~/.ssh/config sets the policy for -L. GatewayPorts in remote host's /etc/ssh/sshd_config sets the policy for -R. – ScumCoder Mar 1 '20 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.