This was my first thought. I’m actually using this right now to set up WireGuard at my house so I can tunnel there from a remote location on several devices that don’t have ssh accounts on the target.

Next in line is ssh -D 9999 remotehost which opens a socks5 proxy on localhost:9999 that tunnels all connections through the remote host. This is especially rad with proxy.pac https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file

And next in line is ssh -L 9999:target_host:80 (or whatever) which tunnels 127.0.0.1:9999 to target_host:80.

Personally I agree. I don’t use the SFF. oP asked for something compact though.

Lil Nas X totally sounds like it would be a valid answer here.

Get an old optiplex SFF off Craigslist for $200 and be done with it. Those things last so long, and since it’s commodity hardware you can replace individual components that break for not much money.

I had a boring manufacturing job with long gaps between batches of work, so I read every help file in Windows NT4.1. While reading them, I found a way around our IT limitations on which apps we could run, and learned how to write scripts. So I wrote a password protected launcher tool using a macro feature in a terminal emulator I had access to on my workstation, and then started reading the man pages in Unix sys-V.