Tunnels allow for specific access into your network using HTTP/HTTPS protocols to provide this. Its better than a VPN in that you aren't granting full access into your network, just a specific pre-defined IP and port inside your network. The user connects to there own localhost IP, and CrushFTP then routes everything over HTTP to the CrushFTP server which then forwards the connection on to the destination IP and port. This is very similar to how SSH tunnels work, except this is all over HTTP/HTTPS.

The user manager configuration lets you grant access to tunnels you have defined in the server prefs to be available to a user.