Have you considered using the same ssh port forwarding mechanism and simply leaving the tunnel up permanently (invoked through a wrapper script to bring it back up if disconnected)?

It seems that tearing the connection up and down from your CGI would introduce complexity and expense - sorry if I misunderstood your setup..