Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux machine (box 1) with Internet service connected to a Wifi router sitting right next to it, through Ethernet (eth0). The purpose of this router is so I can share this Internet connection with another machine (box 2) over Wifi.

Quick diagram:

BOX 1 --> eth0 --> ROUTER --> wifi --> BOX 2

In the router configuration, LAN is (the Ethernet cable with Internet) and WAN is 10.42.42.x

The output of 'ifconfig -a' on BOX 1 identifies eth0 as as expected, but I can't access the router configuration through that address. I can't figure out what address that would be. I can only access the router from BOX 2. That is not ideal, but I can live with it.

BOX 2 has IP number, assigned to it by the Wifi router.

BOX 2 finds BOX 1 on BOX 1 runs a Web server on port 8001 and I can view the pages served by BOX 1 browsing on BOX 2.

The problem:

I have created on BOX 1 an SSH tunnel to a remote machine that runs an email server. Something like this:

ssh -f -q -f -N -C -T -L 9110:

So, on BOX 1, I can configure my email client to poll to download my email securely.

Now I want to do the same on BOX 2, but I can't. I thought I would be able to poll, but that doesn't work.

I am running iptables, but the entire eth0 interface is marked as trusted, and that is probably proven by the fact that I can browse web pages served by BOX 1 from BOX 2. For that reason, I don't believe that iptables is blocking this particular attempt.

What else could it be?

Note: I've searched high and low and found quite a few recipes for making sort of a "multiple hop" tunnel, sort of like two or three connected tunnels. I don't want that. I don't want to have to run sshd on BOX 1 or even ssh on BOX 2. I want to use the tunnel on BOX 1 directly from BOX 2.

share|improve this question
up vote 2 down vote accepted

Check with netstat that the forwarded port is not bound to the local loopback only. You can change this by adding * (any interface), e.g. -L *:9110: You may also have to change / set the GatewayPorts parameter in the server configuration to yes or clientspecified

share|improve this answer
That asterisk did the trick. Thank you! – movingtype May 11 '13 at 5:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.