Lil Nas X totally sounds like it would be a valid answer here.
Get an old optiplex SFF off Craigslist for $200 and be done with it. Those things last so long, and since it’s commodity hardware you can replace individual components that break for not much money.
This was my first thought. I’m actually using this right now to set up WireGuard at my house so I can tunnel there from a remote location on several devices that don’t have ssh accounts on the target.
Next in line is
ssh -D 9999 remotehost
which opens a socks5 proxy on localhost:9999 that tunnels all connections through the remote host. This is especially rad with proxy.pac https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_fileAnd next in line is
ssh -L 9999:target_host:80
(or whatever) which tunnels 127.0.0.1:9999 to target_host:80.