trying to tunnel to madtom through headnode, works on headnode, but connection refused from another host with access to the 10.67.42.x net

gistfile1.txt

setup of matna was for lab, so all zones are running on headnode.

[root@headnode (home) ~]# ifconfig
lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu 8232 index 1
        inet 127.0.0.1 netmask ff000000
e1000g3: flags=1000943<UP,BROADCAST,RUNNING,PROMISC,MULTICAST,IPv4> mtu 1500 index 2
        inet 10.67.41.2 netmask ffffff00 broadcast 10.67.41.255
        ether 0:25:90:11:7:e2
external0: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 3
        inet 10.67.42.2 netmask fffffe00 broadcast 10.67.43.255
        ether 2:8:20:ea:b0:77
manta0: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 4
        inet 10.77.77.5 netmask ffffff00 broadcast 10.77.77.255
        ether 90:b8:d0:8c:3b:9b
lo0: flags=2002000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv6,VIRTUAL> mtu 8252 index 1
        inet6 ::1/128
[root@headnode (home) ~]# cat .ssh/config
Host madtom
  User root
  Hostname 10.67.42.2
  LocalForward 8068 10.67.41.68:80
  ServerAliveInterval 300

madtom info:
[root@headnode (home) ~]# vmadm get afa24ce0-1f34-457b-ad40-7dee0cd0338b
{
  "zonename": "afa24ce0-1f34-457b-ad40-7dee0cd0338b",
  "autoboot": true,
  "brand": "joyent-minimal",
  "limit_priv": "default",
  "v": 1,
  "create_timestamp": "2015-12-19T22:41:19.469Z",
  "image_uuid": "aab21bbc-97a6-11e5-8e35-7f467136794d",
  "cpu_shares": 4,
  "max_lwps": 2000,
  "max_msg_ids": 4096,
  "max_sem_ids": 4096,
  "max_shm_ids": 4096,
  "max_shm_memory": 512,
  "zfs_io_priority": 100,
  "max_physical_memory": 512,
  "max_locked_memory": 512,
  "max_swap": 1024,
  "billing_id": "00000000-0000-0000-0000-000000000000",
  "owner_uuid": "c2814ec8-1a99-eb25-bce2-904d1f94c969",
  "tmpfs": 512,
  "dns_domain": "local",
  "archive_on_delete": true,
  "resolvers": [
    "10.67.41.6"
  ],
  "alias": "madtom.usw1.pccowboy.com-afa24ce0",
  "nics": [
    {
      "interface": "net0",
      "mac": "90:b8:d0:f9:3a:bc",
      "vlan_id": 100,
      "nic_tag": "manta",
      "netmask": "255.255.255.0",
      "ip": "10.77.77.37",
      "ips": [
        "10.77.77.37/24"
      ],
      "network_uuid": "4fd47059-8fe3-4bee-9b91-448670b462ef",
      "mtu": 1500,
      "primary": true
    },
    {
      "interface": "net1",
      "mac": "90:b8:d0:39:79:4f",
      "vlan_id": 0,
      "nic_tag": "admin",
      "netmask": "255.255.255.0",
      "ip": "10.67.41.68",
      "ips": [
        "10.67.41.68/24"
      ],
      "network_uuid": "fd4c44ec-3102-42a7-8721-0272b5157bc7",
      "mtu": 1500
    }
  ],
  "datasets": [
    "zones/afa24ce0-1f34-457b-ad40-7dee0cd0338b/data"
  ],
  "uuid": "afa24ce0-1f34-457b-ad40-7dee0cd0338b",
  "zone_state": "running",
  "zonepath": "/zones/afa24ce0-1f34-457b-ad40-7dee0cd0338b",
  "zoneid": 67,
  "last_modified": "2015-12-19T22:41:32.000Z",
  "firewall_enabled": false,
  "server_uuid": "12399ec8-ef21-230e-8ee9-0025901107e2",
  "datacenter_name": "home",
  "platform_buildstamp": "20151029T052920Z",
  "state": "running",
  "boot_timestamp": "2015-12-19T22:41:27.000Z",
  "pid": 55623,
  "customer_metadata": {
    "SAPI_URL": "http://sapi.home.pccowboy.com",
    "user-script": "#!/usr/bin/bash\n#\n# This Source Code Form is subject to the terms of the Mozilla Public\n# License, v. 2.0. If a copy of the MPL was not distributed with this\n# file, You can obtain one at http://mozilla.org/MPL/2.0/.\n#\n\n#\n# Copyright (c) 2014, Joyent, Inc.\n#\n\nset -o xtrace\nset -o errexit\nset -o pipefail\n\n#\n# To use the same convention as SDC instances, the presence of the\n# /var/svc/.ran-user-script file indicates that the instance has already been\n# setup (i.e. the instance has booted previously).\n#\n# Upon first boot, run the setup.sh script if present.  On all boots including\n# the first one, run the configure.sh script if present.\n#\nSENTINEL=/var/svc/.ran-user-script\n\nDIR=/opt/smartdc/boot\n\n\nif [[ ! -e ${SENTINEL} ]]; then\n\tif [[ -f ${DIR}/setup.sh ]]; then\n\t\t${DIR}/setup.sh\n\tfi\n\n\ttouch ${SENTINEL}\nfi\n\nif [[ -f ${DIR}/configure.sh ]]; then\n\t${DIR}/configure.sh\nfi\n"
  },
  "internal_metadata": {},
  "routes": {},
  "tags": {
    "manta_role": "madtom"
  },
  "quota": 10,
  "zfs_root_recsize": 131072,
  "zfs_filesystem": "zones/afa24ce0-1f34-457b-ad40-7dee0cd0338b",
  "zpool": "zones",
  "zfs_data_recsize": 131072,
  "snapshots": []
}


curl works:
[root@headnode (home) ~]# curl http://localhost:8068
<html>
  <head>
    <title>Check This</title>
    <!-- http://code.jquery.com/ui/1.10.3/themes/smoothness/jquery-ui.css -->
    <link type="text/css" rel="stylesheet" href="css/jquery-ui.css" />
    <!-- http://jqueryui.com/resources/demos/style.css -->
    <link type="text/css" rel="stylesheet" href="css/jquery-demo-style.css" />
    <link type="text/css" rel="stylesheet" href="css/checker.css">

    <!-- http://code.jquery.com/jquery-1.9.1.js -->
    <script src="js/jquery-1.9.1.js"></script>
    <!-- http://omnipotent.net/jquery.sparkline/2.1.2/jquery.sparkline.js -->
    <script src="js/jquery.sparkline-2.1.2.js"></script>
    <!-- http://code.jquery.com/ui/1.10.3/jquery-ui.js -->
    <script src="js/jquery-ui-1.10.3.js"></script>
    <script src="js/checker.js"></script>
  </head>
  <body>
    <div id="checker"></div><br>
  </body>
  <script type="text/javascript">
    $(document).ready(function () {
            $('#checker').checker();
    });
  </script>
</html>