Restrict user for ssh tunnelling

I'm trying to create a user without shell access just for port forwarding through ssh. The shell of the user is set to

/usr/bin/false

, but everytime i try to login through ssh it receive

denied (publickey,password)

. If I add the

/usr/bin/false

to

/etc/shells

it works but I read that this is not recommended. I also created a rule in

/etc/ssh/sshd_config

of form:

Match User tunneluser
        X11Forwarding no
        AllowTcpForwarding yes
        AllowAgentForwarding no
        PermitTTY no

But it still doesn't work.