Question: I have two machines accessible on the Internet with no NAT involved. Both machines run an SSH service. 

I want to connect via SSH/SFTP to Server A on Port 2000 and this connection should be routed to Server B Port 22 (behavior like a HTTP reverse proxy but using SSH/SFTP instead of HTTP)

![enter image description here](https://i.stack.imgur.com/MgNQm.jpg)

Answer: 
This should be no problem with iptables:

```
#!/bin/bash
export IP="1.2.3.4"
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables \-t nat \-A POSTROUTING \-o eth0 \-d $IP \-j MASQUERADE
iptables \-A PREROUTING \-t nat \-p tcp \--dport 2000 \-j DNAT \--to $IP:22

```
You can use ssh port forward for archive this

```
ssh -L localportinmypc:hostname_of_the_behind_the_firewall:remoteport hostname_of_my_firewall

```

Now after this:

```
sftp -o Port=localportinmyp localhost or ssh -p localportinmyp 

```