add tunnel and ssh wrappers for clients