Filtering by IP is not generally safe enough: any node on the network can broadcast IP packets with any IP in the headers. While it might not be easy for any no

Filtering by IP is not generally safe enough: any node on the network can broadcast IP packets with any IP in the headers. While it might not be easy for any node to pick up traffic destined for a particular IP (depending on the network topology), adding encryption can certainly stop it completely. A tunnel is a simple way to forward any TCP/IP traffic securely between two nodes. If you've got secure entry into a network, tunnel between nodes on that network ensures no eavesdropping or impersonation from another node on that network. Also note that SSH came before VPNs :) You can also bridge two networks over ssh with things like sshuttle.