Self answered(solution identified and not cause).
The text in grey has proved to be a bunch of wrong conclusions.
The corrections and details are to be found in the reply below.
I've recently received a request to install and prepare a machine(virtual with vmware)for an application server in internet. This server should be accesible on port 8080 where a jboss application is listening and providing a web interface.
The server should also be accesible directly from the intranet(other servers) on the same port. However in our company the following policies are applied: internet-intranet(no connections allowed), intranet-internet ssh port allowed(through firewall with nat, although all our IP addresses are public addresses).
Having the following:
subnet A - lab internet network
subnet B - lab intranet network 1
subnet C - lab intranet network 2
subnet D - office intranet network
machine X - vm running redhat in A to hold the web application
machine Y - vm running centos in B to hold a tunnel to X
machine Z - another vm running redhat in C
mylaptop - me in the office
A->*, all reject
B,C,D->A 22 allow, all reject(firewall with NAT)
B,C<->D all allow(firewalled)
B<->C all allow(routed only)
So i did the following:
I created X and assigned it in A. I then created Y and assigned it in B. I then launched on Y the tunnel #ssh -fgNL 8080:127.0.0.1:8080 user@ipX
Now any browser connecting to http://ipY:8080
should automatically receive the responses from ipX:8080
What actually happens:
If i connect from mylaptop to http://ipY:8080, 6 http requests are launched. 3 of those are finished and 3 not. I experience a pretty high load time(for just a login page). The tunnel hangs in that status with those tcp connections and dies in a few minutes.
If i connect from Z to http://ipY:8080, same as above happens.
If i connect from Y(to itself) to http://127.0.0.1:8080
, 6 http requests are launched. 6 of those are finished and everything works great.
If i connect from another VM in same subnet B to http://127.0.0.1:8080, 6 http requests are launched. 6 of those are finished and everything works great.
So from what i see everything outside the subnet of the tunnel head is going chaotic. I only have 1 network interface on all machines so it shouldn't be a routing problem i think.
More strange: if i launch the tunnel from mylaptop(running windows) to A, all other machines in intranet are tunneled perfectly.
Any ideas what is going and where should i investigate further?