diff --git a/system/lxc.nix b/system/lxc.nix
index b8c0623..2385712 100644
--- a/system/lxc.nix
+++ b/system/lxc.nix
@@ -76,7 +76,7 @@
   services.openssh.extraConfig = ''
     Match Group labmates
       ForceCommand /run/current-system/sw/bin/lxc-login
-      AllowTcpForwarding no
+      AllowTcpForwarding local
       X11Forwarding no
   '';