I have trouble understanding the PermitTunnel option in the sshd_config file. How is this option related to the AllowTcpForwarding? Having PermitTunnel no does not seem to have any effect on tunneling to the server.
The man says this about PermitTunnel:
Specifies whether tun(4) device forwarding is allowed. The argument must be yes, point-to-point (layer 3), ethernet (layer 2), or no. Specifying yes permits both point-to-point and ethernet. The default is no. Independent of this setting, the permissions of the selected tun(4) device must allow access to the user.but that doesn't mean much to me.
1 Answer
PermitTunnel is for tunnel devices, which are like virtual network interfaces. They can be used e.g. for VPN connections via SSH, so all traffic to the target network is routed via the tunnel.
On the other hand, TCP forwarding only forwards certain ports from localhost to the target host.
So if you want a full-fledged virtual network interface, use the tunnel devices - you might need root or appropriate CAP privileges to set this up. To access just e.g. a web app via the TCP SSH-tunnel, TCP forwarding is easier to set up and use.
