ssh -D is half the story of the problem, particularly with socks5a DNS over it.

I'm becoming a bigger fan of sshuttle, everytime I need to use it.

Mostly by running SSH over the proxies using a CONNECT string (corkscrew) or using a ssh proxy-command to hop once over out of a DMZ.

Those combinations & composability of ssh is what makes it so much more useful inside a limited network.