ssh tunnel into server behind NAT firewall

local_client:LPORT <—–> GPORT:guser@gateway_server <—-> RPORT:ruser@remote_server

Create the ssh tunnel:

ssh -f guser@gateway_server -L localhost:LPORT:remote_server:RPORT -N

Options: -f: go into background, -N: do not open a shell

Use the tunnel:

ssh -p LPORT ruser@localhost

scp, X forwarding, also works!