Persistent port forwarding without ssh

["Robert S" <robert_s@emailme.net.au>]

I am wanting to set up a VPN using ssh between my office and my home Windows 
PCs, using a debian box at the remote end.  The setup is as follows:

HOME (winxp)- - - -<internet>- - - - DEBIAN ----<internal network>----SERVER 
(win2K)

I have managed to connect (using vnc) to SERVER using PuTTY or ssh at the 
home end thus:

1. log into DEBIAN from HOME using Putty, forward remote port 5900 to local 
port 5901
2. forward port from SERVER to DEBIAN using "ssh -C -g -L 5900:server:5900 
debian"
3. connect vncviewer to local port 5901.

All is fine with this setup.  If I do this with samba using port 139 
however, it fails because I've disabled root ssh logins.

I'd like to set up the above setup where step 2 is replaced by a persistent 
connection that doesn't require a second password entry.  In other words, 
I'd like to forward a port on SERVER to a port on DEBIAN.  I don't want to 
use a private key file because that would have to be located on DEBIAN, with 
obvious security problems.  I assume that this would require something other 
than ssh.

Can you do this with iptables - if so - how?  stunnel does not seem to do 
it - my syslog on DEBIAN indicates a connection, but nothing happens on the 
HOME end.