diff --git a/commands/tunnel.go b/commands/tunnel.go
index bdf2a17c..d3140e82 100644
--- a/commands/tunnel.go
+++ b/commands/tunnel.go
@@ -2,6 +2,7 @@ package commands
 
 import (
 	"fmt"
+	"strconv"
 
 	"github.com/spf13/cobra"
 
@@ -42,6 +43,25 @@ func init() {
 // tunnelFn ...
 func tunnelFn(ccmd *cobra.Command, args []string) {
 
+	if tunnelCmdFlags.port != "" {
+		port, err := strconv.Atoi(tunnelCmdFlags.port)
+		if err != nil {
+			fmt.Printf(`
+Please specify a number for a port to listen on. You specified '%s'.
+
+`, tunnelCmdFlags.port)
+			return
+		}
+
+		if port < 1024 {
+			fmt.Printf(`
+Please specify a number above 1023 as a port to listen on. You specified '%d'.
+
+`, port)
+			return
+		}
+	}
+
 	env, _ := models.FindEnvByID(config.EnvID())
 	args, location, name := helpers.Endpoint(env, args, 2)
 
diff --git a/util/display/messages.go b/util/display/messages.go
index 4de09348..370a68a7 100644
--- a/util/display/messages.go
+++ b/util/display/messages.go
@@ -302,7 +302,7 @@ func UnexpectedPrivilage() {
 --------------------------------------------------------------------------------
 + ERROR:
 + Nanobox is designed to run as a standard user (non root)
-+ Please run all nanobox commands as a non privilage user
++ Please run all nanobox commands as a non privileged user
 --------------------------------------------------------------------------------
 
 `))
@@ -327,6 +327,16 @@ the '-p' flag. (eg. 'nanobox tunnel data.db -p 5444')
 `, port))
 }
 
+func PortPrivileged(port string) {
+	os.Stderr.WriteString(fmt.Sprintf(`
+--------------------------------------------------------------------------------
+PRIVILEGED PORT
+Port '%s' is a privileged port. Please specify a port greater than 1023 with
+the '-p' flag. (eg. 'nanobox tunnel data.db -p 5444')
+--------------------------------------------------------------------------------
+`, port))
+}
+
 func ConsoleNodeNotFound() {
 	os.Stderr.WriteString(fmt.Sprintf(`
 --------------------------------------------------------------------------------
diff --git a/util/nanoagent/tunnel.go b/util/nanoagent/tunnel.go
index d41fb241..71c944d8 100644
--- a/util/nanoagent/tunnel.go
+++ b/util/nanoagent/tunnel.go
@@ -28,6 +28,10 @@ func Tunnel(key, location, port, name string) error {
 	}
 	defer conn.Close()
 
+	if port == "22" {
+		port = "2022"
+	}
+
 	// setup a tcp listener
 	serv, err := net.Listen("tcp4", fmt.Sprintf(":%s", port))
 	if err != nil {
@@ -38,7 +42,12 @@ func Tunnel(key, location, port, name string) error {
 		if strings.Contains(err.Error(), "address already in use") || err == syscall.EADDRINUSE {
 			display.PortInUse(port)
 			err2.Code = "USER"
-			err2.Suggest = fmt.Sprintf("It appears your local port (%s) is in use. Please specify a different port.", port)
+			err2.Suggest = fmt.Sprintf("It appears your local port (%s) is in use. Please specify a different port with '-p'.", port)
+		}
+		if strings.Contains(err.Error(), "bind: permission denied") || err == syscall.EACCES {
+			display.PortPrivileged(port)
+			err2.Code = "USER"
+			err2.Suggest = fmt.Sprintf("It appears you don't have permission to use port '%s'. Please specify a different port with '-p'.", port)
 		}
 
 		return util.ErrorAppend(err2, "failed to setup tcp listener")