browse over ssh

in addition to
ssh -ND destination.ip.com

set up in
about:config in iceweasel
network.proxy.socks_remote_dns to true!

then all dns requests go out over ssh instead of over nework directly.