Getting DDM to work through an SSH tunnel

I've got Telnet working over an SSH tunnel between two iSeries servers, but I can't seem to get DDM to work over an SSH tunnel.

I submit a program like this to create the Telnet tunnel
PGM
DCL VAR(&CMD) TYPE(*CHAR) LEN(500)
CHGVAR VAR(&CMD) VALUE('/QOpenSys/usr/bin/ssh -T -N +
-L 20001:localhost:23 as400c')
CALL PGM(QP2SHELL) PARM('/QOpenSys/usr/bin/sh' +
'-c' &CMD)
ENDPGM

Once the tunnel is active, I can connect to the remote server through the tunnel like this:
TELNET RMTSYS(LOCALHOST) PORT(20001)


But when I try to do a tunnel for DDM like this:
PGM
DCL VAR(&CMD) TYPE(*CHAR) LEN(500)
CHGVAR VAR(&CMD) VALUE('/QOpenSys/usr/bin/ssh -T -N +
-L 21001:localhost:446 as400c')
CALL PGM(QP2SHELL) PARM('/QOpenSys/usr/bin/sh' +
'-c' &CMD)
ENDPGM

I can get the tunneling job to run and it listens for connections. I create a DDM file like this:
CRTDDMF FILE(QTEMP/TEMPDDMF) RMTFILE(Library/file) RMTLOCNAME('127.0.0.1' *IP) PORT(21001)

When I actually attempt to use the DDM file, I get an error like so:
SBMRMTCMD CMD(WRKSPLF) DDMFILE(QTEMP/TEMPDDMF)
Cannot establish DDM connection with remote system.

I'm pretty sure that 446 is the right port. For non-tunneled DDM files, I see port 446 in use on the NETSTAT screen.

Am I attempting the impossible? Does anyone have any suggestions?

Thanks,
Trent Douthat