Question: I have two machines accessible on the Internet with no NAT involved. Both machines run an SSH service. 

I want to connect via SSH/SFTP to Server A on Port 2000 and this connection should be routed to Server B Port 22 (behavior like a HTTP reverse proxy but using SSH/SFTP instead of HTTP)

![enter image description here](https://i.stack.imgur.com/MgNQm.jpg)

Answer: 
You can use ssh port forward for archive this

```
ssh -L localportinmypc:hostname_of_the_behind_the_firewall:remoteport hostname_of_my_firewall

```

Now after this:

```
sftp -o Port=localportinmyp localhost or ssh -p localportinmyp 

```
Something like:

```
ssh -o ProxyCommand="ssh -e none userA@serverA:2000 nc -w 1 serverB 22" userB@ServerB

```

where you connect to *serverA* with ssh login *userA* for opening a *forward* connection to *serverB* to wich you log in with *userB*.

**Explanation:**

The proxy command open a ssh connection to *ServerA* (with username *userA*) and initiate a bidirectional connection to port 22 of *serverB*.

The initial `ssh` command use this `ProxyCommand` to establish a bidirectional connection to *ServerB* where you have to log in with *userB*.

In fine:

There is a crypted connection from Laptop to ServerA (step 1 in your drawing) and

another crypted connection from Laptop to ServerB (step 1 + step 2), encapsulated in first connection in his first part (step 1), than binded by `nc` in the second part (step2).

Instead of HTTP, As `SSH` is bidirectional, when a connection is open, all requests and answers follow the same connection. So there is no need to think about your step 3 and 4.