The problem was related with the permissions of the security group that was involved. Once that was fixed I could make this work, even without the trick of the tunnel