explicitly set client=no in tunnel configs when appropriate

- while this is unnecessary due to default value being no, explicitly
  setting the value adheres to the principle of least surprise.