This question already has an answer here:

I'm using on Windows machine:

plink -C -L 3333:<internal-server-ip>:80 -N -i keyfile.ppk <user>@<mydomain>

where <mydomain> is an ubuntu 14.04.2 LTS with SSH and keyfile-only remote logins.

I noticed that I can actually port forward to anything behind the NAT on my network through <mydomain> server. I need a guide on how to limit this possibility in such a way, that <user> would be able to port forward only to specific <internal-server-ip> or group thereof?

marked as duplicate by Rinzwind, Eric Carvalho, Community Jun 1 '15 at 17:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


I think this is almost the same question as here: How to create a restricted SSH user for port forwarding?

The solution there is very comprehensive and should be also applicable for your problem.

Not the answer you're looking for? Browse other questions tagged or ask your own question.