Why might packets go into a tunnel and not come out

All,

This is a question that I would have posted to linux-net had it still 
existed. I beg your indulgence.

I have established an SSH tunnel (device tunX) between two remote hosts. 
This tunnel is operating properly in that I can ping each peer from the 
other.

I am now trying to route traffic through this tunnel to onward 
destinations. This is not working: when I ping such an onward 
destination I can see the packets going into the tunnel (using tcpdump) 
but they're not coming out of the other end (again as seen by tcpdump).

I have added logging to all firewall rules that drop or reject traffic; 
nothing is logged. (And yes I have checked that logging itself works by 
briefly adding logging to an ACCEPT rule). Routing is enabled on both 
hosts. The counters for the tun devices (as seen using ifconfig) do not 
show any dropped traffic.

I am not asking you to debug my problem for me, but could anyone please 
point me to an overview of the reasons why packets might be going into 
one end of a tunnel and not come out the other end? I have studied the 
diagram at the following link and I think I've checked the potential 
issues that it prompts:

http://www.shorewall.net/Shorewall_and_Routing.html

Many thanks.

Jan