ssh -Y sets up an ssh tunnel just for X/Windows traffic. That tunnel makes X believe it is sending X/Client stuff to the localhost, i.e. 127.0.0.x/8, so it works.

If you don't want to use ssh...