diff --git a/pkg/hostagent/hostagent.go b/pkg/hostagent/hostagent.go
index 7fc3cbb523d..32998b5d8de 100644
--- a/pkg/hostagent/hostagent.go
+++ b/pkg/hostagent/hostagent.go
@@ -153,6 +153,22 @@ func New(instName string, stdout io.Writer, signalCh chan os.Signal, opts ...Opt
 		AdditionalArgs: sshutil.SSHArgsFromOpts(sshOpts),
 	}
 
+	ignoreTCP := false
+	ignoreUDP := false
+	for _, rule := range y.PortForwards {
+		if rule.Ignore && rule.GuestPortRange[0] == 1 && rule.GuestPortRange[1] == 65535 {
+			switch rule.Proto {
+			case limayaml.TCP:
+				ignoreTCP = true
+				logrus.Info("TCP port forwarding is disabled (except for SSH)")
+			case limayaml.UDP:
+				ignoreUDP = true
+				logrus.Info("UDP port forwarding is disabled")
+			}
+		} else {
+			break
+		}
+	}
 	rules := make([]limayaml.PortForward, 0, 3+len(y.PortForwards))
 	// Block ports 22 and sshLocalPort on all IPs
 	for _, port := range []int{sshGuestPort, sshLocalPort} {
@@ -188,8 +204,8 @@ func New(instName string, stdout io.Writer, signalCh chan os.Signal, opts ...Opt
 		instName:          instName,
 		instSSHAddress:    inst.SSHAddress,
 		sshConfig:         sshConfig,
-		portForwarder:     newPortForwarder(sshConfig, sshLocalPort, rules, inst.VMType),
-		grpcPortForwarder: portfwd.NewPortForwarder(rules),
+		portForwarder:     newPortForwarder(sshConfig, sshLocalPort, rules, ignoreTCP, inst.VMType),
+		grpcPortForwarder: portfwd.NewPortForwarder(rules, ignoreTCP, ignoreUDP),
 		driver:            limaDriver,
 		signalCh:          signalCh,
 		eventEnc:          json.NewEncoder(stdout),
diff --git a/pkg/hostagent/port.go b/pkg/hostagent/port.go
index 4c39b953d50..10b34703750 100644
--- a/pkg/hostagent/port.go
+++ b/pkg/hostagent/port.go
@@ -14,6 +14,7 @@ type portForwarder struct {
 	sshConfig   *ssh.SSHConfig
 	sshHostPort int
 	rules       []limayaml.PortForward
+	ignore      bool
 	vmType      limayaml.VMType
 }
 
@@ -21,11 +22,12 @@ const sshGuestPort = 22
 
 var IPv4loopback1 = limayaml.IPv4loopback1
 
-func newPortForwarder(sshConfig *ssh.SSHConfig, sshHostPort int, rules []limayaml.PortForward, vmType limayaml.VMType) *portForwarder {
+func newPortForwarder(sshConfig *ssh.SSHConfig, sshHostPort int, rules []limayaml.PortForward, ignore bool, vmType limayaml.VMType) *portForwarder {
 	return &portForwarder{
 		sshConfig:   sshConfig,
 		sshHostPort: sshHostPort,
 		rules:       rules,
+		ignore:      ignore,
 		vmType:      vmType,
 	}
 }
@@ -94,7 +96,9 @@ func (pf *portForwarder) OnEvent(ctx context.Context, ev *api.Event) {
 		}
 		local, remote := pf.forwardingAddresses(f)
 		if local == "" {
-			logrus.Infof("Not forwarding TCP %s", remote)
+			if !pf.ignore {
+				logrus.Infof("Not forwarding TCP %s", remote)
+			}
 			continue
 		}
 		logrus.Infof("Forwarding TCP from %s to %s", remote, local)
diff --git a/pkg/limayaml/limayaml.go b/pkg/limayaml/limayaml.go
index 4b3bc1cdd7c..f932e6aa9f8 100644
--- a/pkg/limayaml/limayaml.go
+++ b/pkg/limayaml/limayaml.go
@@ -214,6 +214,7 @@ type Proto = string
 
 const (
 	TCP Proto = "tcp"
+	UDP Proto = "udp"
 )
 
 type PortForward struct {
diff --git a/pkg/portfwd/forward.go b/pkg/portfwd/forward.go
index cf616d8de4d..c6bad28e5af 100644
--- a/pkg/portfwd/forward.go
+++ b/pkg/portfwd/forward.go
@@ -15,18 +15,30 @@ var IPv4loopback1 = limayaml.IPv4loopback1
 
 type Forwarder struct {
 	rules             []limayaml.PortForward
+	ignoreTCP         bool
+	ignoreUDP         bool
 	closableListeners *ClosableListeners
 }
 
-func NewPortForwarder(rules []limayaml.PortForward) *Forwarder {
-	return &Forwarder{rules: rules, closableListeners: NewClosableListener()}
+func NewPortForwarder(rules []limayaml.PortForward, ignoreTCP, ignoreUDP bool) *Forwarder {
+	return &Forwarder{
+		rules:             rules,
+		ignoreTCP:         ignoreTCP,
+		ignoreUDP:         ignoreUDP,
+		closableListeners: NewClosableListener(),
+	}
 }
 
 func (fw *Forwarder) OnEvent(ctx context.Context, client *guestagentclient.GuestAgentClient, ev *api.Event) {
 	for _, f := range ev.LocalPortsAdded {
 		local, remote := fw.forwardingAddresses(f)
 		if local == "" {
-			logrus.Infof("Not forwarding %s %s", strings.ToUpper(f.Protocol), remote)
+			if !fw.ignoreTCP && f.Protocol == "tcp" {
+				logrus.Infof("Not forwarding TCP %s", remote)
+			}
+			if !fw.ignoreUDP && f.Protocol == "udp" {
+				logrus.Infof("Not forwarding UDP %s", remote)
+			}
 			continue
 		}
 		logrus.Infof("Forwarding %s from %s to %s", strings.ToUpper(f.Protocol), remote, local)