I've not found a true "on-demand" solutions for ssh tunnels. Here is the definition (to me):
- A host (whether local or remote) has a listening service on port XXX
- A client (again, local or remote) connects to port XXX
- Host then initiates a pre-defined ssh connection to another host and sets up appropriate port forwarding, authentication typically handled for the client.
- The client is then able to use that connection based on the port forwarding.
As near as I can tell there is no software that currently enables the "on-demand" part; as defined by a service that is actively listening for connections. You can obviously start a service that creates the tunnel, but that is of course a manual operation.
Currently my solution is using launchd to keep an ssh connection open all the time. I used this blog post to craft my own solution:
If you update your question I could probably help you roll your own, again, this is a dedicated solution not "on-demand".
As an alternative to this, you can look as SSH Tunnel Manager or the afore mentioned TunnelBlick to start tunnels manually.