My use case is the (presumably common one) of being able to ssh out of a corporate network to a machine on the public Internet (e.g. your home machine), from which you want to tunnel back to the corporate network.

On the server, set "PermitTunnel yes" in /etc/ssh/sshd_config, and run (as root):

    sysctl -w net.ipv4.ip_forward=1
    ip tuntap add dev tun0 mode tun
    ip addr add $SERVER/32 peer $CLIENT/32 dev tun0
    ip link set dev tun0 up
    arp -sD $CLIENT eth0 pub

On the client, run (as root):

    ip tuntap add dev tun0 mode tun
    ip addr add $CLIENT/32 peer $SERVER/$PREFIX dev tun0
    ip link set dev tun0 up

The above settings need only be run once (unless you reboot the machines).

Back on the server, as your normal user, run "ssh -w 0:0 user@$CLIENT" to establish the connection. The -N, -f, -oExitOnForwardFailure=yes, and -oServerAliveInterval=15 options may also be desired.

$SERVER is the IP of the computer in the network you want to tunnel into.

$CLIENT is the IP selected for the computer you want to tunnel from. Note: it is not the client's public IP! You should pick an unused one on the destination network. If you can't do this, then you can only tunnel to the server itself.

$PREFIX is the size of the prefix of the network you want to forward (typically 16 or 24).

If you only want to tunnel to the server itself, then $PREFIX should be 32, and you can skip the sysctl and arp commands on the server.

If you have other tunX devices in use, adjust the tunnel device numbers accordingly (don't forget about changing ssh's -w argument too).

This won't work if the client is also behind a NAT gateway or on a private network.