with --tunnel switch, remote clients default to using ssh tunnels