Filtering by IP is not generally safe enough: any node on the network can broadcast IP packets with any IP in the headers. While it might not be easy for any node to pick up traffic destined for a particular IP (depending on the network topology), adding encryption can certainly stop it completely.

A tunnel is a simple way to forward any TCP/IP traffic securely between two nodes. If you've got secure entry into a network, tunnel between nodes on that network ensures no eavesdropping or impersonation from another node on that network.

Also note that SSH came before VPNs :) You can also bridge two networks over ssh with things like sshuttle.