Open SSH connection to gateway internet facing machine from private network target machine.

root@serial:~# ssh -R 12345:localhost:22 internet.example.com
Last login: Sat Mar 10 10:26:52 2018 from a.b.c.d
Welcome to pg1x main server!

[wnoguchi@internet ~]$

OK, let's ssh to from internet facing machine to above ssh machine.

[wnoguchi@internet ~]$ ssh localhost -p 12345
The authenticity of host '[localhost]:12345 ([::1]:12345)' can't be established.
ECDSA key fingerprint is SHA256:1/9giDamZizVKtN6cFai3F9w+ybsQNCwt1dNkx2ZgVw.
ECDSA key fingerprint is MD5:aa:df:d2:c8:df:20:70:c4:b8:83:93:1f:a5:e1:9d:87.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[localhost]:12345' (ECDSA) to the list of known hosts.
wnoguchi@localhost's password:
Welcome to Ubuntu 17.10 (GNU/Linux 4.13.0-36-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

 * Meltdown, Spectre and Ubuntu: What are the attack vectors,
   how the fixes work, and everything else you need to know
   - https://ubu.one/u2Know

2 packages can be updated.
0 updates are security updates.

Last login: Fri Mar  9 20:57:16 2018 from 192.168.123.111
✘╹◡╹✘  18-03-10 10:32:54 /home/wnoguchi
%

more

man ssh

have fun!

1. Can ssh service be accessed in private network? - Super User
2. Reverse SSH Tunneling
3. SSH Tunnel - Local and Remote Port Forwarding Explained With Examples - Trackets Blog