Open SSH connection to gateway internet facing machine from private network target machine.
root@serial:~# ssh -R 12345:localhost:22 internet.example.com Last login: Sat Mar 10 10:26:52 2018 from a.b.c.d Welcome to pg1x main server! [wnoguchi@internet ~]$
OK, let's ssh to from internet facing machine to above ssh machine.
[wnoguchi@internet ~]$ ssh localhost -p 12345 The authenticity of host '[localhost]:12345 ([::1]:12345)' can't be established. ECDSA key fingerprint is SHA256:1/9giDamZizVKtN6cFai3F9w+ybsQNCwt1dNkx2ZgVw. ECDSA key fingerprint is MD5:aa:df:d2:c8:df:20:70:c4:b8:83:93:1f:a5:e1:9d:87. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[localhost]:12345' (ECDSA) to the list of known hosts. wnoguchi@localhost's password: Welcome to Ubuntu 17.10 (GNU/Linux 4.13.0-36-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage * Meltdown, Spectre and Ubuntu: What are the attack vectors, how the fixes work, and everything else you need to know - https://ubu.one/u2Know 2 packages can be updated. 0 updates are security updates. Last login: Fri Mar 9 20:57:16 2018 from 192.168.123.111 ✘╹◡╹✘ 18-03-10 10:32:54 /home/wnoguchi %
more
man ssh
have fun!