That's not the entire truth. TCP over TCP is not a good mix, but SSH tunnels are different. SSH tunnels are not VPN tunnels. SSH will act as the endpoint for y

That's not the entire truth. TCP over TCP is not a good mix, but SSH tunnels are different. SSH tunnels are not VPN tunnels. SSH will act as the endpoint for your TCP application and only tunnel the application payload over SSH (TCP). On the other side a new TCP session will be opened over which that payload is sent. So you never do TCP over TCP. It's more so a proxy than a tunnel and that avoids the real issue, which is nested congestion control. In addition SSH should also be able to do so with less overhead (in bytes) than a VPN (which need to forward the IP and TCP header intact), but I don't know how well SSH takes advantage of that. SSH tunneling can outperform OpenVPN running in TCP or UDP mode.