A tunnel and a VPN have a similar structure. You create a communication channel which crosses the firewall boundary and pump data through it. The channel is setup using authentication, so only certain people can do this, and is encrypted, etc., so that the channel is secure.
At either end of the channel, the hosts have to figure out the routing of network channel, diverting it to and from local processes and the great wide world network as required. A VPN does this whole-sale: all traffic from the client host goes into the channel, tunnels through the firewall inside this channel, is unpacked on the other side of the firewall, and is dropped onto that network imitating truely local traffic.
Another method is to forward only certain connections, identified by TCP port number, through a firewall tunnel. Ssh has a forwarding mechanism which can move network packets from a port/host source to a port/host destination through an ssh session. We use this to map ports on localhost to machines and ports in the network inside the firewall, with an ssh session between the localhost (typically outside the firewall) to any server runnding sshd inside the firewall (and accessible according to firewall rules).
Ssh rules can get long, so the file ~/.ssh/config is usefull. See man ssh_config(5). The general idea is:
Host sherman HostName sherman.cs.miami.edu ForwardX11 yes Host sherman_tunnels HostName sherman.cs.miami.edu LocalForward 1080 sherman:1080 LocalForward 8080 sherman:80 LocalForward 25 sherman:25 LocalForward 143 sherman:143 LocalForward 515 172.20.0.102:515 LocalForward 139 172.20.0.101:139 LocalForward 16286 129.171.58.30:16286Running ssh sherman looks for a sherman host entry in .ssh/config, and finding these lines, will set up 7 tunnels. They are for SOCKs, HTTP, SMTP (mail), IMAP, printer, and netbios-ssn, as well as a license server for Mathematica. Once the ssh completes, traffic to localhost port 143, for instance, will end up on sherman, port 143, where there is an imapd listening. Once the ssh completes, my local mail client can imap mail from sherman simply by requesting it as if the imap process was running local, on port 143.
Similarly, printing is done, once the tunnel is in effect, by standard Unix networking printing protocols to the seemingly local network printer localhost (127.0.0.1).
Similarly, Windows NT directories can be mounted by redirecting requests locally. Here is the command that works for me on OS X:
mount_smbfs -I 127.0.0.1 //docserver/burt ~/docserverRid yourself of this using umount ~/docserver. It takes time to have the icon show up on the the desktop, and I haven't got Eject to work through the GUI once it does. In fact, it stalls the desktop big time. Reboot required to clear it.
It should also be possible to do Finder->Go->Connect and specify smb://127.0.0.1 but this isn't being friendly at this time.