rewrite to support ssh tunnels