Alex Regan writes:
I'm familiar with how remote ssh tunnels work, but can't quite get systemctl to create a proper service, presumably because ssh expects to be tied to a terminal.
I did this a looooong time ago, so visualize me waving my hands frantically. You presumably want the "-n" flag (detaches from stdin), or possibly the "-f" flag (implies "-n" but allows prompting for a passphrase, but that doesn't seem to be appropriate for a service).
The man page is pretty good, and has a discussion of using the tun(4) network pseudo-device.
Regards,