Forwarding controls are SSH configuration settings that decide whether a session may create tunnels or relay traffic to another host. They govern features such as local port forwarding, remote port forwarding, dynamic SOCKS forwarding, and sometimes agent or X11 forwarding. In practice, these options determine whether SSH is only a remote shell or also a transport for other connections.
They matter because forwarding turns one trusted SSH session into a gateway. Attackers abuse allowed forwarding to pivot deeper into a network, reach internal services, or hide command-and-control traffic inside an encrypted tunnel. Defenders restrict forwarding on jump hosts and servers to limit lateral movement and data exfiltration. Common controls include disabling forwarding by default, allowing it only for specific users or hosts, and auditing when tunnels are created.