I wrote a follow up post to this on SSH tunneling: https://news.ycombinator.com/item?id=22665037