not what you want at all, but it came to mind. openbsd has it's authpf system, where you ssh in, and the system installs firewall rules.

http://man.openbsd.org/authpf

Something similar probably exists for linux as well.

Some days what I really want is shttp, http over ssh.