ssh tunnel over NAT or firewall (chained ssh)

Your target server is running e.g. vncserver on port 5904. Your gateway has a free port 6111. Your client has a free port 333

client:~> ssh -A -t  user1@gateway -L 3333:localhost:6111 \
           ssh -A user2@target -L 6111:localhost:5904

Then:

client:~> vncviewer ::3333