[J-Kuhn]

But... this doesn't work for SSH, which is the problem here?

[XorNot]

SSH has ProxyCommand which accepts the %h template.

Provided your users will configure something a little - or you provide a wrapping command - you can setup the tunneling for them.