gistfile1.txt

On local system, ~root/.ssh/config:

Host chef_server
  IdentityFile /root/.ssh/chef_tunnel
  User chef_client
  Hostname gateway.example.com
  Port 2022 # open port 2022 on your firewall to NAT to 22 on chef server
  LocalForward 4400 my-chef-server:4000 # chef
  LocalForward 4401 my-chef-server:4001 # openid
### end .ssh/config ###

ports are > 1024, root access not necessary.
as root, 
  ssh-keygen -f /root/.ssh/chef_tunnel
create chef_client user on chef server. 
put public ssh key w/o passphrase in ~chef_client/.ssh/authorized_keys. 
on client, before connecting to chef server:
  ssh chef_client@chef_server

this can go in a runit service.