Brings up a TUN interface via ssh -w and routes traffic from specific VM source IPs
through it using policy routing + conntrack marks. Inbound traffic to those VMs is
unaffected (CONNMARK ensures only VM-initiated connections are tunnelled).
Optionally, also forwards connections arriving on the remote side (host/proto/port) back through the tunnel to a specific VM on the gateway's LAN — a DNAT+SNAT port-forward anchored at the remote end. A forward may be a single port or an inclusive port range, which is always mapped 1:1 onto the same ports on the VM.