It would be useful to disallow some forwardings while leaving others, e.g. DenyOpen 127.*:* or PermitOpen !127.*:* *