diff --git a/ssh/misc.c b/ssh/misc.c
index 6bf9ce4..7be2955 100644
--- a/ssh/misc.c
+++ b/ssh/misc.c
@@ -639,7 +639,7 @@ tun_open(u_int tun, int mode)
 		snprintf(name, sizeof(name), "/dev/tun%u", tun);
 		fd = open(name, O_RDWR);
 	} else if (tun == SSH_TUNID_ANY) {
-		for (i = 100; i >= 0; i++) {
+		for (i = 100; i >= 0; i--) {
 			snprintf(name, sizeof(name), "/dev/tun%u", i);
 			if ((fd = open(name, O_RDWR)) >= 0) {
 				tun = i;