How to allow port forward only to a specific network or to a specific port?

Question

linux

The user connects via ssh.
How to allow it to port forward only to certain networks?
For example, so that he could do this:

ssh  [email protected] -L localhost:2222:192.168.10.2:22

But I couldn't do it like this:
ssh [email protected] -L localhost:2222:mail.ru:80

We are talking about old centos 6.

Answer 1

https://linux.die.net/man/5/sshd_config setting PermitOpen
But this is anyway protection from honest people.
Perhaps it would be better to set up a firewall on a remote machine if there should be no access from it at all ...