Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux machine (box 1) with Internet service connected to a Wifi router sitting right next to it, through Ethernet (eth0). The purpose of this router is so I can share this Internet connection with another machine (box 2) over Wifi.

Quick diagram:

BOX 1 --> eth0 --> ROUTER --> wifi --> BOX 2

In the router configuration, LAN is (the Ethernet cable with Internet) and WAN is 10.42.42.x

The output of 'ifconfig -a' on BOX 1 identifies eth0 as as expected, but I can't access the router configuration through that address. I can't figure out what address that would be. I can only access the router from BOX 2. That is not ideal, but I can live with it.

BOX 2 has IP number, assigned to it by the Wifi router.

BOX 2 finds BOX 1 on BOX 1 runs a Web server on port 8001 and I can view the pages served by BOX 1 browsing on BOX 2.

The problem:

I have created on BOX 1 an SSH tunnel to a remote machine that runs an email server. Something like this:

ssh -f -q -f -N -C -T -L 9110:

So, on BOX 1, I can configure my email client to poll to download my email securely.

Now I want to do the same on BOX 2, but I can't. I thought I would be able to poll, but that doesn't work.

I am running iptables, but the entire eth0 interface is marked as trusted, and that is probably proven by the fact that I can browse web pages served by BOX 1 from BOX 2. For that reason, I don't believe that iptables is blocking this particular attempt.

What else could it be?

Note: I've searched high and low and found quite a few recipes for making sort of a "multiple hop" tunnel, sort of like two or three connected tunnels. I don't want that. I don't want to have to run sshd on BOX 1 or even ssh on BOX 2. I want to use the tunnel on BOX 1 directly from BOX 2.

share|improve this question
up vote 2 down vote accepted

Check with netstat that the forwarded port is not bound to the local loopback only. You can change this by adding * (any interface), e.g. -L *:9110: You may also have to change / set the GatewayPorts parameter in the server configuration to yes or clientspecified

share|improve this answer
That asterisk did the trick. Thank you! – movingtype May 11 '13 at 5:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .