This question already has an answer here:
I'm using on Windows machine:
plink -C -L 3333:<internal-server-ip>:80 -N -i keyfile.ppk <user>@<mydomain>
<mydomain> is an ubuntu 14.04.2 LTS with SSH and keyfile-only remote logins.
I noticed that I can actually port forward to anything behind the NAT on my network through
<mydomain> server. I need a guide on how to limit this possibility in such a way, that
<user> would be able to port forward only to specific
<internal-server-ip> or group thereof?