In the context of Compute Canada, SSH tunnelling is necessary in certain cases, because compute nodes on Niagara and Graham do not have direct access to the internet, nor can the compute nodes be contacted directly from the internet.