IIRC can't an SSH tunnel leak your browsing through DNS leaks, or am I misunderstanding? I thought you usually want to use an actual VPN protocol like Wireguard.