I mean you can yeah, but more realistically, you'd use nginx, ha-proxy, or envoy etc and handle layer 4 traffic that way. So unless you had a really bad config I can't see that going wrong, at least by default. I just do layer 4 tunneling, no vpn. Although Im starting to fiddle with ssh tunneling for things that really need some sort of client initiated tunneling.