Using proxmox special agent without having access to port 8006

Can I teach check-mk to open a tunnel when doing the normal agent check, and to use the tunnel with the special agent, or will the ssh connection for the normal agent already be closed by then? Or would I need a static ssh-tunnel (or openVpn/Wireguard connection)?
If i assume the proxmox server is a.example.com then, as far as I understood, the special agent would try to connect to a.example.com. How can I convince it to connect to localhost to use the ssh-tunnel?